ROT HACKERSACADEMYStart learning
Courses/Injection & Browser Testing/Lesson 05
05.05 / 55 min

Test SSRF with local OAST

Prove destination filtering and blind-callback evidence using a local interaction ledger.

By the endTest internal destination rulesRecord a blind callbackAvoid outbound scanning
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health
Expected result

200 with "local_only": true.

02

Reset the interaction ledger

POST /oast/reset and verify count zero. This prevents an old interaction from being attributed to the new request.

03

Compare destination policy

Send the lab callback URL to both fetch routes. The secure control blocks loopback; the insecure route records a simulated fetch.

GET /fetch-insecure?url=http%3A%2F%2F127.0.0.1%3A5177%2Foast%2Fcallback%2Fssrf-proof
Expected result

Secure 403, insecure 200.

04

Correlate the callback

GET /oast/interactions and match source, URL, timestamp, and request evidence. Treat missing correlation as inconclusive.

05

Document the limitation

This is an offline simulation. Real blind SSRF requires a controlled callback domain explicitly authorized for the engagement.

MASTERY CHECKPOINT

Prove it before moving on.

The result includes a unique local interaction and clearly states that no real outbound request occurred.