Fetch · Glitcher University

Import from link

Objective Make the server fetch an INTERNAL-only resource it can reach but you can't.

💡 Show hint

The import tool fetches any URL server-side. Point it at the internal metadata service the recon leaked: http://metadata.internal/latest/meta-data/

FlawThe server fetches arbitrary user-supplied URLs (SSRF). FixAllow-list destinations; block internal/link-local ranges and redirects.