diff --git a/src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask2.java b/src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask2.java index 35f9491f77..40edbf4d1f 100644 --- a/src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask2.java +++ b/src/main/java/org/owasp/webgoat/lessons/ssrf/SSRFTask2.java @@ -48,7 +48,7 @@ public AttackResult completed(@RequestParam String url) { protected AttackResult furBall(String url) { if (url.matches("http://ifconfig\\.pro")) { String html; - try (InputStream in = new URL(url).openStream()) { + try (InputStream in = new URL("https://example.com/" + String.valueOf(url).replaceAll("^\\w+://.*?/", "")).openStream()) { html = new String(in.readAllBytes(), StandardCharsets.UTF_8) .replaceAll("\n", "
"); // Otherwise the \n gets escaped in the response