SSRF
Hard · SSRF

Redirect Validation Bypass

ReportForge blocks direct requests to its internal report service, but the UI also exposes an approved company redirector used by its own documentation links. The renderer validates only the first URL and automatically follows redirects.

Objective

Start from the working redirect example shown in ReportForge and change only its destination so the second hop reaches the internal daily export endpoint displayed in Service Status.

Target

FetchLab apps

Launch target

Submit flag