Lab 92 — EventPulse — SSRF via IPv6 Bypass in Webhook Verification

hackadvisor

Task: EventPulse webhook platform with URL verification feature that has IPv4-only SSRF blocklist. Solution: Bypass string-based URL filter using IPv6-mapped IPv4 address [::ffff:127.0.0.1] to reach internal metadata service on port 3001 and retrieve flag from /internal/flag.