Internal URL health check
This tool fetches a URL to check it is up. To stop people probing the box it runs on, requests to localhost are refused.
Reachable internal path for this service: /flag
The check target is pinned to this site and locked
in the form; override the url field in the request body with an intercepting proxy to change it.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.