> For the complete documentation index, see [llms.txt](https://rejenthompson.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rejenthompson.gitbook.io/writeups/burpsuite/ssrf-attack-walkthrough.md).

# SSRF ATTACK : WALKTHROUGH

## Vulnerability Report: Server-Side Request Forgery (SSRF)

### **Description**

The web application is vulnerable to Server-Side Request Forgery (SSRF) attacks, allowing an attacker to make requests on behalf of the server, potentially leading to unauthorized access to internal resources.

### **Affected Endpoint**

URL: <https://0ad6005c04f2986f80802110005600c2.web-security-academy.net/admin>

### **Exploitation Steps**

#### **1. Access Restrictions Bypass:**

The admin interface is protected and not directly accessible.

Using the stockApi parameter, an attacker can manipulate requests to bypass access restrictions.

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2FhkFAmbFg7yJrGGGLmgj3%2FScreenshot%202024-02-25%20at%202.38.24%E2%80%AFAM.png?alt=media&amp;token=d1b9eef1-8a17-4467-97cc-4d79de2527b9" alt="" width="563"><figcaption></figcaption></figure>

#### **2. Burp Suite Analysis:**

• Intercepted a request triggered by clicking ”Check stock.” Sent the intercepted request to Burp Repeater for further analysis

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2FEeCQVAbNLEuA4g5LbOmZ%2FScreenshot%202024-02-25%20at%202.39.29%E2%80%AFAM.png?alt=media&amp;token=e3b268ae-4225-4646-b91a-dc02ec0c8326" alt=""><figcaption></figcaption></figure>

#### **3. SSRF Exploitation:**

Changed the stockApi parameter to <http://localhost/admin>.

Successfully accessed the administration interface, demonstrating SSRF vulnerability.

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2FRxAZpXOSbgADlLhgUBhZ%2FScreenshot%202024-02-25%20at%202.38.24%E2%80%AFAM.png?alt=media&amp;token=1ae70702-abd7-4b99-a2d9-9adaa65dc962" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2FBHuDvHb6jp8x6qLbVXmU%2FScreenshot%202024-02-25%20at%2012.31.08%E2%80%AFAM.png?alt=media&amp;token=1d2d0211-683a-40f0-9588-69a2bf0b825e" alt=""><figcaption></figcaption></figure>

#### **4.Identified Target User Deletion URL:**

• Discovered the URL for deleting a target user: <http://localhost/admin/delete>? username=carlos

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2F4kmQFV7uJrdzVev6pyyc%2FScreenshot%202024-02-25%20at%202.46.45%E2%80%AFAM.png?alt=media&amp;token=f39556b1-0c91-46f6-a502-d14b4fef2f1d" alt=""><figcaption></figcaption></figure>

#### **5.SSRF Attack Execution:**

• Submitted the identified deletion URL via the stockApi parameter to perform the SSRF attack.

<figure><img src="https://3821730555-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCJMPuCQbMwIYqUJNCa28%2Fuploads%2FHdMmGFVmUXF5BNvFnm5B%2FScreenshot%202024-02-25%20at%202.48.07%E2%80%AFAM.png?alt=media&amp;token=ffdb0d2e-d11b-4541-bb4b-d3a360957150" alt=""><figcaption></figcaption></figure>

After changing the stock api the user carlos is deleted&#x20;

### Recommendation

It is recommended to implement proper input validation and sanitisation for user- supplied input. Additionally, access controls should be strengthened to prevent unauthorized access to internal resources.

### Remediation Steps

1\. Validate and sanitise user inputs to prevent manipulation of the stockApi

2\. Implement strong access controls to restrict access to sensitive functionalities and resources