Server-Side Request Forgery (SSRF)- PortSwigger Labs

Lab: SSRF with filter bypass via open redirection vulnerability

SSRF Attack Lifecycle

Lab: SSRF with filter bypass via open redirection vulnerability

Objectives:

This lab has a stock check feature that fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at http://192.168.0.12:8080/admin and delete the user carlos.

The stock checker has been restricted to only access the local application, so you will need to find an open redirect affecting the application first.

Lab: SSRF with filter bypass via open redirection vulnerability

Lab: SSRF with filter bypass via open redirection vulnerability | Web Security Academy

Lab walkthrough

In this lab we can access two features -Check stock and the Next product

Vulnerable App-Check stock and Next product features

This time stockApi is making HTTP request to the path /product/stock/check?productID=3&storeID=1 not an IP or domain/application

HTTP Request-stockApi

We have captured also newProduct HTTP Request and looks like there is a redirection here (HTTP 302 Found)

HTTP 302 Found Request-nextProduct

After following the redirection we are presented with HTTP 200 OK Response