SnapProof webhook SSRF
A document-notarization service. The completion webhook URL is fetched server-side with no restriction.
PentestingHere Academy
Official Academy lab
- Attempts
- 4
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
SnapProof notarizes documents and calls a webhook_url you provide the moment notarization finishes, fetching it directly from the server.
Goal
There is an internal status page, internal-status.php, that answers only requests from 127.0.0.1, so you cannot reach it directly. Make the server fetch it for you and return its contents. The flag is on that page.