JuicedShop Security Lab Series: Server-Side Request Forgery (SSRF)
Solution overview
Type: Red Team
Who Should Play: Security analysts, penetration testers, application security engineers, and technical leaders want to deepen their understanding of web application vulnerabilities through hands-on offensive techniques.
Objective:
This mini game explores how attackers can exploit web applications that allow user-supplied URLs to perform unintended actions on behalf of the server. You'll locate a feature within JuicedShop that accepts an external URL, and use it to trick the server into making requests it shouldn't.
By crafting malicious input, you'll demonstrate how SSRF can be used to access internal services, probe protected networks, or even deliver malware through the server itself. What begins as a simple link field can quickly escalate into a major security risk.
Why it matters: SSRF vulnerabilities are especially dangerous in cloud, native, and microservice-heavy environments. They allow attackers to pivot inside trusted infrastructure and bypass external protections. This mini game reinforces the importance of validating user input, even when the user isn't directly interacting with sensitive resources.
About the JuicedShop Mini Game Series:
Challenge yourself in a dynamic, hands-on mini game series based on OWASP Juice Shop, a purposefully vulnerable web application replicating real-world security flaws in a safe, sandboxed environment. This interactive experience includes ten unique mini games, each aligned with a specific vulnerability from the OWASP Top Ten - the most critical web application security risks recognized by the industry.
Whether you're exploring web app security for the first time or refining advanced ethical hacking skills, this series offers an engaging, gamified way to practice identifying, exploiting, and understanding common flaws found in modern websites.
Included Mini Games:
- JuicedShop Security Lab Series: Broken Access Control
- JuicedShop Security Lab Series: Cryptographic Failures
- JuicedShop Security Lab Series: Injection Attacks
- JuicedShop Security Lab Series: Insecure Design
- JuicedShop Security Lab Series: Security Misconfiguration
- JuicedShop Security Lab Series: Vulnerable and Outdated Components
- JuicedShop Security Lab Series: Identification and Authentication Failures
- JuicedShop Security Lab Series: Software and Data Integrity Failures
- JuicedShop Security Lab Series: Logging and Monitoring Failures
- JuicedShop Security Lab Series: Server-Side Request Forgery (SSRF)
These bite-sized mini games are designed to sharpen offensive testing techniques and deepen your understanding of how vulnerabilities can be discovered and exploited in real-world scenarios.
How to Get Started
- Click the "Launch lab" button on the right side of this page
- Once inside the virtual environment, watch the video in the "Start Here" tab of your lab gateway for next steps
- Good luck and have fun!