How to exploit a basic SSRF vulnerability?

The challenge in this writeup is from Portswigger's web security academy lab. You can access it here for Free.

The challenge

We need to access the admin panel and delete the user called Carlos. We can only access the admin panel from the internal network.

The details we have

They have given us the details about the SSRF vulnerable endpoint. Stock check is the feature where SSRF vulnerability is present. Also, the admin interface URL is given.

Exploring the app

The landing page of the lab.

On viewing any of the product details we could see an option to check stock.

The below request is being sent to the server whenever we check the stock.

The first door to the solution

Let's change the stock URL with the URL given on the challenge home page.

When we send the above request, we get the admin interface in the place of stock details.

The Final task

The primary task we have to complete is to delete the user named Carlos.

There is a delete button near the username Carlos. If we click the button, a GET request is sent to the server from our browser.

However, the response is permission denied. What went wrong???

The server will only accept all admin-requests only if it is coming from the internal network. Otherwise, it will reject the request.

So, just as we accessed the admin panel earlier, we should send the user-deletion request.

What can we do to delete the user `Carlos`?

Let's exploit the SSRF vulnerability present in the stock check feature, and send the user deletion request via exploiting the SSRF, which will hopefully delete the user Carlos.

Revisits the `admin` page

Now if we go again to the admin page through the stock check endpoint, we could see only one user there. The user Carlos has successfully deleted.

We solved an easy lab Basic SSRF against the local server from Portswigger's Web security Academy.

How to exploit a basic SSRF vulnerability?

Comments (1)

More from this blog

XSS Vulnerability: A Quick Guide for Entry-Level Developers

How to fix XSS vulnerabilities in Node.js and expressJS

Top 7 methods to find account takeover bugs in 2023

How I got $400 for my first SSRF bug?

The challenge

The details we have