Daily Hack
A fresh 60-second challenge every day. Solve it, earn XP, and keep your streak alive.
SSRF to the internal KV store
This health-check fetcher has a guard: it blocks external hosts but happily allows loopback, because "only internal services live there." That assumption is the bug. Probe the loopback interface, follow the hint the server leaks when you knock on the wrong door, and pull the flag out of the internal key-value store it points you to.
Play freely - sign up to submit your answer and earn XP.
Credited contributors
These hackers reported issues, improved content, and helped harden this page.