SSRF with blacklist-based input filter | Dec 24, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you'll learn: SSRF with blacklist-based input filter! Without further ado, let's dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos.

The developer has deployed two weak anti-SSRF defenses that you will need to bypass.

Exploitation

Home page:

In the previous labs, we found that the stock check feature has a Server-Side Request Forgery(SSRF) vulnerability:

We clicked the Check stock button, it'll send a POST request to /product/stock, with parameter stockApi, and it's value is interesting:

URL decoded:

http://stock.weliketoshop.net:8080/product/stock/check?productId=1&storeId=1

Now, what if I change the domain to localhost?

It gets blocked.

How about 127.0.0.1?

Same.

To bypass this filter, we can use refer to HackTricks:

Let's use 127.1:

Hmm… Still getting blocked.

Maybe the application is checking the word admin?

If in that case, we can obfuscate that word:

Nice! We now can reach the admin panel.

Let's delete user carlos:

We did it!

What we've learned:

SSRF with blacklist-based input filter