Live endpoint, not a description of one

Try to make my server
fetch something it shouldn’t.

The audit tool on this site takes a web address from a stranger and fetches it. That is the most hostile input a public endpoint can accept, because an address is an instruction to make a request from inside the network, and inside the network is where the cloud keeps its credentials.

So here is the guard, wired to a box. Type an address that should never be fetched. The answer names the IP it resolved to and says which hop was refused.

Or click one of these. Each is a real bypass, and the note says what it defeats.

The page content is never returned to you, only the status line, the resolved addresses and the hop chain. Handing back the body would turn a demonstration of the defence into a way through it.

What it is doing while you wait

01

It resolves the name first, then judges the addresses

A check on the text of a hostname is a check on a string. Any domain can point an A record at 127.0.0.1, and then the string looks perfectly ordinary. So the name is resolved, and every address that comes back is judged against the private, loopback, link-local, carrier-grade NAT, unique-local, 6to4, NAT64 and IPv4-mapped ranges.

02

It hands the socket the address it checked

Resolving and then calling fetch means two lookups, and the second one can come back different. That gap is the whole DNS rebinding attack. The validated address is passed straight to the connection, so there is no second lookup to poison.

03

It walks redirects by hand

Following redirects internally and checking the final address afterwards inspects the corpse. The request to the metadata service has already been sent and answered by then. Every hop is judged before it is sent, and credentials are dropped when the host changes.

Two addresses that beat it

Both of these are in the list above, and both of them used to work. They are listed here because showing the fix is ordinary and showing what got past you is not.

http://localhost.

The first version compared the hostname against a list of names. A trailing dot is a valid, fully qualified way of writing the same host, and it is not in any list. It went straight through.

Nothing compares hostnames any more. The address it resolves to is what gets judged.

http://[::ffff:7f00:1]/

The IPv6 table asserted that ::ffff:127.0.0.1 was refused, and never tried the same address written in hex. A reviewer walked through that gap to a loopback server. My own test had agreed with my own code, so it found nothing.

Both spellings are refused, and the test asserts both. Tests that agree with the code are decoration.

There are 74 tests on this boundary alone, and 250 across the tool. Nearly every one of them is a bug that actually happened.

Same guard, same file, no demo mode. If it ever regressed, this page would start saying “allowed through” for the addresses above. The endpoint describes itself in a browser. What the tokens cost is measured rather than estimated. The MCP server hands agents a key that opens one door. The tool it protects takes your own web address and tells you what is broken on it, and every defect it has had is written down with the test that catches it now, next to the eval that found three of them.