Case 2 — Site Audit crawler fetch

Reporter: SSRF into the internal network via customSitemapStartUrl.

Endpoint:

POST /siteaudit/api/crawl
Content-Type: application/x-www-form-urlencoded
X-Api-Key: sk_bob_9d2e5f41a0c84b17

customSitemapStartUrl=http://example.com/sitemap.xml

Try an external URL, then internal ones: http://127.0.0.1/, http://169.254.169.254/, http://100.64.1.1:8500/, http://10.0.0.5/.

Triage questions: is the response body returned (or only a status)? What actually answers on internal addresses? Is this a working exfil or a blind reachability oracle of expected crawler behaviour?

H1 Triage Range - training mock. All data, keys and emails are fictional. Fetch and external APIs are simulated. ← home