> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/ssrf/lab-1.md).

# Lab 1

### What is SSRF?

Server-side request forgery is a web security vulnerability that allows an attacker to cause the server-side application to make requests to an unintended location.

In a typical SSRF attack, the attacker might cause the server to make a connection to internal-only services within the organization's infrastructure. In other cases, they may be able to force the server to connect to arbitrary external systems. This could leak sensitive data, such as authorization credentials.

<figure><img src="/files/AxKuO0qe39abdbgDDqbY" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/SUSP4xHB0jPCRIzl19HS" alt=""><figcaption></figcaption></figure>

This one is wrong: the payload that should work is:<br>

<figure><img src="/files/rRTf422R67Sh2te6wSFE" alt=""><figcaption></figcaption></figure>

```
Localhost is a hostname that refers to the current computer being used, typically resolving to the IP address 127.0.0.1. It allows the computer to communicate with itself, often used for testing and development purposes without needing a physical network.
```