Lab5: SSRF via flawed request parsing

Server-Side Request Forgery (SSRF) is a web security vulnerability where an attacker tricks a vulnerable web server into making unauthorized requests to internal or external systems

Solution:

Access the lab send the GET / request to repeater:

Changing Host to anything's it's give 403 response:

Double Host header also not works:

Next I supply an absolute URL in the request:

It works so in Host header i use burp collaborator url:

Now like previous lab do brute forcing:

Note: Uncheck the "Update Host Header to match target"

Done got one 302 response

Send it to repeater & change path to /admin in url:

Copy & open response in browser then use Username carlos to delete it:

Not works but send that response to repeater:

Change the Host header & URL path:

Send it to delete the carlos user & solve the lab.

Thanks For Reading