← All Challenges
Challenge 33 of 66
Server Spy
🟠 Hard
Web App
+100 XP
A URL preview feature fetches any URL you provide. Trick it into fetching an internal service at http://169.254.169.254/flag.
SSRF = Server-Side Request Forgery. The server fetches URLs for you — including internal ones.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free