Loading page
Review the challenge brief, files, and requirements.
A URL preview worker fetches user-supplied URLs and can reach internal services that the public site cannot.
POST /api/preview
Content-Type: application/json
{"url": "https://example.com"}
Pivot through the preview endpoint, reach the internal admin-only service, and recover the hidden flag.
Sign in to attempt this challenge.
Use Proving Grounds to continue your challenge practice.
Open Proving Grounds