When the server fetches for you

A helpful link preview

The target has a link-preview helper at /app/fetch: you hand it a URL and the server fetches it and hands you back the body. Point it at the site's own home page and it works as advertised:

curl -s 'http://127.0.0.1:8080/app/fetch?url=http://127.0.0.1:8080/' | head -5

In the terminal

student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/fetch?url=http://127.0.0.1:8080/' | head -5
<!doctype html>
<title>VulnTech Target</title>
<h1>VulnTech Practice Target</h1>
<p>This machine hosts the deliberately-vulnerable apps for the Web Pentesting
labs. Everything here runs only inside your browser VM on 127.0.0.1.</p>

Notice who made that second request: not your browser, but the server. Whatever the server can reach, this feature can reach — and a server usually sits inside a trusted network with neighbours you can't touch from outside. That gap is server-side request forgery.