Medium
Server-Side Request Forgery
GreenGrid firmware-import redirect SSRF
A solar-fleet monitoring dashboard. A host allow-list is checked once, before any redirect is followed.
PentestingHere Academy
Official Academy lab
- Attempts
- 3
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
GreenGrid lets fleet admins import inverter firmware "from a URL". The import only accepts URLs on updates.greengrid-fleet.example, checked when the URL is submitted.
Goal
The importer only fetches from updates.greengrid-fleet.example. Make it reach the internal-only firmware service instead (a host it should never touch) and return the flag that service serves.