Protecting an Image Fetcher from SSRF is a practical course for beginners who can enter terminal commands. A shop's image feature can reach an internal service that shoppers cannot access directly. Follow that request, then repair the feature without breaking approved images.
Two Guided Labs introduce network roles, URL parsing, an exact endpoint policy, and redirect rejection. One Challenge applies the same methods to two partner catalogs in an independent environment.
What You Will Learn
- Identify which server actually fetches an image and interpret its real request records.
- Compare client and server reachability using synthetic internal data.
- Edit a small Python policy that compares complete scheme, hostname, and port combinations.
- Reject redirects and prohibited destinations while keeping correct image bytes and legitimate inventory access available.
Who This Course Is For
For web-security beginners and developers exploring server-side request forgery. Basic terminal familiarity is required; networking, HTTP, and the necessary Python syntax are introduced locally.
Each unit provides prepared Linux terminals, isolated container networks, an Image Importer, and a Topology view. The internal data is synthetic; requests and network isolation are real. No local installation is needed.
Frequently Asked Questions
Do I need to know Python? No. You edit a short existing helper, with its tuple comparisons, Boolean values, indentation, and editor controls explained.
Does this protect every image service? The exercise uses fixed, controlled service identities and direct images. It does not cover hostile DNS changes, arbitrary internet URLs, or every URL encoding.
What does the Challenge assess? Correct image imports, exact endpoint restrictions, rejected redirects, and preserved internal business access, using the methods practiced in the Guided Labs.
