Lab4: Routing-based SSRF

SSRF (Server‑Side Request Forgery) is a web vulnerability where an attacker tricks a server into making unauthorized internal or external network requests, potentially exposing internal services, sensitive data, or enabling further attacks such as port scanning or even remote code execution.

And In this lab I access the internal admin panel & delete user carlos.

Solution:

Send the GET / request to repeater & change Host header to burp collaborator url (if it response i able to request to the internal services)

It works:

The internal service is in the 192.168.0.0/24 range, so i change the host in repeater & change it to 192.168.0.0 to see the response:

The IP is incorrect so i have to find one from /24 subnates, Send it intruder to bruteforce:

Note: uncheck the "update host header to match target"

Start attack:

Got one 302 response code & that has /admin endpoint reflected in response. Send this to repeater:

From /admin got the delete endpoints, Next open response in browser

In browser use Username carlos to delete:

It simply not works but send that response to repeater:

It not works because Host header is changed, change it to that IP:

lab solved.

Thanks For Reading