RSS feed importer
Submit a feed URL to import. The importer fetches it in the background and only ever replies "queued" — you never see the response. Prove the request actually fires.
Your out-of-band collaborator host
7e4379d3b84884be.oob.cspshivam-collab.test
Any request that reaches this host (or a subdomain of it) is logged for you.
The feed URL is pinned to this site and locked in
the form; override the url field in the request body with an intercepting proxy to point it at
your collaborator host.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.