Level 4 — URL Reputation

The ShieldGuard server fetches and analyzes a URL ・ Vulnerability: SSRF ・ ★★★☆☆

This level simulates a network. It never makes a real outbound request to an arbitrary external site (that would let a public endpoint be abused as an open proxy). Only reachability to a simulated internal host (e.g. 169.254.169.254) is being tested.

URL Reputation Analyzer

Direct requests to internal hosts are blocked. However, this site has an endpoint that redirects to wherever a parameter tells it to.
Goal: reach the internal API (169.254.169.254 / metadata.internal / admin.internal.shieldguard).