Server-side Request Forgery (SSRF) ⭐ Lab 5 | PortSwigger Academy

Hi everyone, today we’ll learn “SSRF with filter bypass via open redirection” vulnerability Lab 5. I hope you will like it, don’t hesitate if you have any questions or say if I made any mistakes.

We’ve already explained how SSRF works in Lab 1. For those who haven’t done Lab 1 & 2–3–4. I invite them to do so to better understand Lab 5.

I advise you to learn how HTTP works before starting this lab.

/The product name may not be the same!! But no problem, the logic is the same\

/I advise you to encode the url but you are not obligated. It’s a good habit\

Lab 5: SSRF with filter bypass via open redirection vulnerability (5. Apprentice)

1. Go to any product and intercept the “Check Stock” request in Burp Suite, and send it to Burp Repeater.
2. We will check if a redirect vulnerability is open in stockApi. We find that this is not applicable.
3. Likewise, we’ll see “Next product” and Intercept this request in Burpsuite.
4. We see that any product redirects to another page. “product/nextProduct?currentProductId=4&path=/product?productId=5”
5. Now, we know that intern redirect is possible.

6. We’ll take “/product/nextProduct?currentProductId=2&path=” and we're going to put stockApi=/product/nextProduct?currentProductId=2&path=http://192.168.0.12:8080/admin

The Next product is used with the “GET” method but stockApi is used with POST Method.

GET carries request parameter appended in URL string while POST carries request parameter in message body.

7. We’ll use URL encoding this path.

8. Now, we can delete the user “Carlos”. We have successfully finished this lab. “stockApi= /product/nextProduct?currentProductId=2&path=http://192.168.0.12:8080/admin/delete?username=carlos” with URL Encoding.

See you next time, enjoy it!