← All labs
SSRF Level 4 / 6 Hard

Via Open Redirect

The fetcher refuses internal hosts, but follows redirects. Chain them.

Webhook tester

Enter a webhook URL and the server sends a test request to it. Internal and loopback addresses are rejected. The client follows HTTP redirects, like most HTTP libraries do by default.

A public redirector is available at http://open.uncrypt.io/redirect?url=

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.