Blind SSRF to cloud metadata
Prove that a server-side request forgery with no visible response can still reach an internal service, and write the finding so a triager cannot close it as informational.
- Difficulty
- Intermediate
- Time
- 55 min
- Tools
- 3
- Walkthrough
- Included
Included in the free Recon tier, once
What you are walking into
Spoiler-free by policy. The setting and the class of flaw, never the parameter, the path or the credential.
An internal document processing service accepts a job description from an authenticated user and fetches a resource on the user side of the network to complete the job. The response never comes back to you. The lab environment includes an out-of-band collaborator so you can observe what the server does rather than guess, and a simulated instance metadata service on the internal network so the impact is real inside the sandbox and reachable nowhere else.
What you will practise
- Distinguish a blind SSRF from a broken feature using out-of-band observation only
- Enumerate what the server can reach when you cannot see the response
- Explain why an allow-list on the hostname is not the same control as an allow-list on the resolved address
- Write the impact statement that turns this from informational to high
What this assumes
Prerequisites
- You can read and replay an HTTP request in an intercepting proxy
- You know what a DNS lookup is and can read a DNS query log
- Familiarity with the term server-side request forgery, which the glossary covers
Tools used
- Burp Suite Community
- Any out-of-band collaborator
- curl
Certification objectives
- BSCP-2.4
- OSWA-3.1
Are you ready for this one?
One question, answered honestly, tells you more than the difficulty label does.
A server fetches a URL you control and returns nothing to you. Your collaborator sees a DNS lookup for your domain but no HTTP request. What does that tell you?
- The vulnerability does not exist, because no request was made
- Something resolved your hostname but did not, or could not, complete the connection
- The server is vulnerable to DNS rebinding and nothing else
- The response was cached
Show the answer
Answer: B.
A DNS lookup with no follow-up connection means the name was resolved by something on the path: the application, a proxy, or a security control that resolves before deciding. It narrows the question from "is there a request" to "what happened between resolution and connection", which is exactly the distinction the lab is built around. It is also the point at which most people stop and report nothing.
How this lab goes
- Completions
- 0
- Median time
- 55 min
- Rating
- Not yet rated
- Ratings
- 0
Median time is the authored estimate. Completion and rating figures are zero because the platform has not launched, and they are shown as zero rather than hidden: an invented statistic on a page like this is worth less than an empty one.
What is behind the sign-in
The sandbox, the guided task list with per-task validation, progressive hints that cost nothing to unlock, and the full text walkthrough. The walkthrough is not published here and will not be: a public walkthrough is a public answer key, and the room stops being worth doing.
Where this sits
Cyber VK Lab Engineering
Pre-publication content owner
Internal ownership label for lab material and walkthroughs.
Updated
[ Related ]
- GlossaryServer-Side Request ForgeryServer-side request forgery is a vulnerability in which an attacker causes a server to make an HTTP request to a destination the attacker chooses, using the server as the origin of that request instead of their own machine.
- ArticleWhy your SSRF report gets closed as informationalMost blind SSRF reports are closed without a payout, and usually for the same three reasons. Here is what a triager is actually looking for, and how to supply it without touching anything you should not.
- GlossaryInsecure Direct Object ReferenceAn insecure direct object reference is an access control failure in which an application uses a user-supplied identifier to select a record and does not check that the requesting user is allowed to see that particular record.
- CTF roomLedger DriftA small internal accounting application with a self-service export feature and an authorisation model that was written before the tenanting was.
- GlossaryCross-Site Request ForgeryCross-site request forgery is a vulnerability in which a site an attacker controls causes a victim browser to send a state-changing request to a different site where the victim is already authenticated, using credentials the browser attaches automatically.
- LabIDOR in a multi-tenant invoice APIFind an object-level authorisation failure in a tenanted API and demonstrate cross-tenant access without touching another real customer.