Server-Side Request Forgery

Cross-platform resources for Server-Side Request Forgery: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

Server-Side Request Forgery

This page aggregates cross-platform resources to practice Server-Side Request Forgery: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/index.html

HTB machines practicing Server-Side Request Forgery (10)

Machine	OS	Difficulty
AdmirerToo	Linux	HARD
Dab	Linux	HARD
Forge	Linux	MEDIUM
Fulcrum	Linux	INSANE
Haircut	Linux	MEDIUM
Kotarak	Linux	HARD
Love	Windows	EASY
Minion	Windows	INSANE
OverGraph	Linux	HARD
Time	Linux	MEDIUM

PortSwigger labs practicing Server-Side Request Forgery (11)

Lab	Difficulty	Topic	Official
Basic SSRF against another back-end system	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Basic SSRF against the local server	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Blind SSRF with Shellshock exploitation	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Open
SSRF with whitelist-based input filter	APPRENTICE	SSRF (Server-Side Request Forgery)	Open
Blind SSRF with out-of-band detection	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open
Routing-based SSRF	PRACTITIONER	HTTP Host Header Attacks	Open
SSRF via flawed request parsing	PRACTITIONER	HTTP Host Header Attacks	Open
SSRF via OpenID dynamic client registration	PRACTITIONER	OAuth Authentication	Open
SSRF with blacklist-based input filter	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open
SSRF with filter bypass via open redirection vulnerability	PRACTITIONER	SSRF (Server-Side Request Forgery)	Open

TryHackMe rooms practicing Server-Side Request Forgery (4)

Room	Difficulty	Type	Access	Official
Advent of Cyber 2023	EASY	Walkthrough	🟢 Free	Open
Intro to SSRF	EASY	Walkthrough	🔵 VIP	Open
Wordpress: CVE-2021-29447	EASY	Challenge	🟢 Free	Open
SSRF	MEDIUM	Walkthrough	🟢 Free	Open

Related skills

• /en/skills/xss
• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-05-09