Link preview
Paste a URL and the server fetches it and shows you the response — handy for previewing a link before you click it. It will fetch anything it can reach from where it runs.
The preview target is pinned to this site and
locked in the form. Overriding the url field in the request body — with an intercepting proxy —
is the only way to point it elsewhere.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.