Server-Side Request Forgery

Cross-platform resources for Server-Side Request Forgery: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Server-Side Request Forgery: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 25 challenges across 3 platforms — 10 HackTheBox · 11 PortSwigger · 4 TryHackMe. 10 with a Spanish writeup, 10 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Basic SSRF against another back-end system (Apprentice) · 🇬🇧
2. PortSwigger — Basic SSRF against the local server (Apprentice) · 🇬🇧
3. PortSwigger — Blind SSRF with Shellshock exploitation (Apprentice) · 🇬🇧
4. PortSwigger — Exploiting XXE to perform SSRF attacks (Apprentice) · 🇬🇧
5. PortSwigger — SSRF with whitelist-based input filter (Apprentice) · 🇬🇧
6. TryHackMe — Advent of Cyber 2023 (Easy · ~1440 min) · 🇬🇧

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/index.html

HTB machines practicing Server-Side Request Forgery (10)

Machine	OS	Difficulty	Writeup
AdmirerToo	Linux	HARD	🇪🇸 🇬🇧 📹
Dab	Linux	HARD	🇪🇸 🇬🇧 📹
Forge	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Fulcrum	Linux	INSANE	🇪🇸 🇬🇧 📹
Haircut	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Kotarak	Linux	HARD	🇪🇸 🇬🇧 📹
Love	Windows	EASY	🇪🇸 🇬🇧 📹
Minion	Windows	INSANE	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Time	Linux	MEDIUM	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Server-Side Request Forgery (11)

Lab	Difficulty	Topic	Official
Basic SSRF against another back-end system	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Basic SSRF against the local server	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Blind SSRF with Shellshock exploitation	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Open
SSRF with whitelist-based input filter	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Blind SSRF with out-of-band detection	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open
Routing-based SSRF	PRACTITIONER	HTTP Host Header Attacks	Open
SSRF via flawed request parsing	PRACTITIONER	HTTP Host Header Attacks	Open
SSRF via OpenID dynamic client registration	PRACTITIONER	OAuth Authentication	Open
SSRF with blacklist-based input filter	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open
SSRF with filter bypass via open redirection vulnerability	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open

TryHackMe rooms practicing Server-Side Request Forgery (4)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2023	EASY	Walkthrough	🟢 Free	Open
Intro to SSRF	EASY	Walkthrough	🔵 VIP	Open
Wordpress: CVE-2021-29447	EASY	Challenge	🟢 Free	Open
SSRF	MEDIUM	Walkthrough	🟢 Free	Open

Related skills

• /en/skills/xss
• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-08-17