All labs › Port Scanning

🔍 Port Scanning

Mapping what is listening, and reading what the response time tells you when the port says nothing at all.

11 labs and targetsfree accountlesson included

How request forgery actually works — taught by The XSS Rat

What it is

CSRF abuses the browser's habit of attaching credentials to any request to a site, so a page you control can act as the victim. SSRF abuses the server's position inside the network, turning it into your proxy to things you cannot reach from outside.

How I attack it

For CSRF: strip the token and see if the endpoint still accepts the request. Then try a wrong token, an empty token, and another user's token.
Check the method and content type - plenty of JSON endpoints happily accept a form post.
For SSRF: anywhere the app fetches a URL is a candidate - webhooks, importers, PDF renderers, image proxies, link previews.
Prove impact beyond a callback: cloud metadata, internal admin panels, ports that should not be reachable.