> For the complete documentation index, see [llms.txt](https://shadowforge.gitbook.io/shadowforge-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shadowforge.gitbook.io/shadowforge-writeups/bugforge.io/readme.txt/daily-labs/ssrf/tanuki.md).

# Tanuki

> Today the hint was ***web***, but pretty quick I realised it was BugForge's first ever ***SSRF*** lab.

When opening up the lab, I immediatly saw the new feature 'Leaderboard'. So I was pretty sure that it was there that I needed to look.

In BurpSuite I saw a POST request, with an URL. So now I was certain I had to try ***SSRF***.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FrNIKG4PmPmcvsyULWwmW%2Fimage.png?alt=media&amp;token=48524173-e5b9-48bd-85da-43b2266667f2" alt=""><figcaption></figcaption></figure>

First thing I tried was reaching an `/admin` endpoint.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FvLzTzS0ibiOAwM06uxnP%2Fimage.png?alt=media&amp;token=83954960-0530-4c0e-9e47-5c9c3aa49368" alt=""><figcaption></figcaption></figure>

And so I rather quickly solved that SSRF lab and got my flag 🇧🇪