- 1 current stop: learning
- 2 upcoming
- 3 upcoming
- 4 upcoming
- 5 upcoming
Finish after stop 5
Stop 1 of 5 · Reception: the helpful courier
Trick to keep in mind+3 XP
In SSRF your server is the courier, walking through doors you could never open.
In a link preview, the request to the pasted address is made by your server, not the visitor's browser. The server sits inside your network, so it may reach admin pages, unauthenticated databases and cloud metadata endpoints that are closed to the outside world. The visitor only chooses the destination and lets the server walk in on their behalf. It is a confused-deputy problem.
Read it once, then a question tests whether the trick stuck.