SSRF with whitelist-based input filter | Dec 24, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: SSRF with whitelist-based input filter! Without further ado, let’s dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos.

The developer has deployed an anti-SSRF defense you will need to bypass.

Exploitation

Home page:

In the previous labs, we found that the stock check feature is vulnerable to Server-Side Request Forgery(SSRF).

When we clicked the Check stock button, it’ll send a POST request to /product/stock, with parameter stockApi, and it’s value is interesting.

URL decoded:

http://stock.weliketoshop.net:8080/product/stock/check?productId=1&storeId=1

Now, what if I change the domain to localhost?

Hmm… The host must be stock.weliketoshop.net.

To bypass that, we can use @:

The application didn’t block us.

Next, we can use the # to create an HTML anchor:

However, this time didn’t work.

Let’s try to double URL encode that:

We bypassed that!

Now, we can try to reach the localhost, which is the admin interface:

Nice! We now can reach the admin panel!

Let’s delete user carlos!

We did it!

What we’ve learned:

SSRF with whitelist-based input filter