what's going on everyone in this video we're gonna talk about ssrf or server
side request forgery if you don't know what server side request forgery is it's
essentially exploiting a vulnerability within web applications or apis or some
entity that's trying to rather than use itself talk to an external server and
you're going to exploit that by making it not talk to the server that he thinks
he wants to talk to it's actually going to talk to another server so this
bypasses firewall rules and it's kind of hard to explain so i'm just going to
show you to to give you a better idea of this and to do that i'm going to use the
port swigger academy and we're using the ssrf lab and what this wants us to do is
use the web application to delete the user car loss and to do that we need to
use the internal endpoint which is on this ip range but
it doesn't give you the exact ip so we need to find that and use the admin
interface on port 8080 to delete that user
so hopping into the web application it's a shop and if we go on to one of the
items you can see that there's this chop check stock level uh functionality so if
we intercept that we can see there's a stock api parameter and it's
using an ip address to a different endpoint
so it's not the same host so as soon as we can see it's using a different
endpoint than the actual host we can automatically think server side request
forgery so if i just go ahead and unintercept that
we can see it's come up with the 914 units so if i reintercept that send that
to intruder what we want to do is try and find another ip address on that
range with the admin endpoint so if i get rid of
all of this and then we change it to the admin
endpoint we can now see that the ip address is pointing
at one and the admin but we want to find what ip address that admin endpoints on
so we're going to use the intruder functionality with a payload of numbers
and one two two five five and we're going to step in ones and what that's
going to do it's going to try all of the ip addresses 192.160.1
all the way to 255 to try and find this admin endpoint so if i go ahead and run
that eventually we're going to see
here we go so we can see it's done one two three four five and when it's hit 15
it's got this 200 status meaning uh it's found
that admin endpoint so if we just render that you'll you'll see it
you can it's found that endpoint and to show you that in practice so if i
rerun this check stock system you can see it's 293 units at the moment that's
the legitimate response if we change this to 15 and we change this to admin
that's actually going to be loaded within this page
like that we can't just click delete though
because that would be us trying to access that endpoint rather
than the web application trying to access that endpoint we've gotta again
use that check stock stock system to delete carlos um so what i mean by that
is at the moment because we're coming and seeing this web application from an
external view we can't use 192.80.15 to access this endpoint
because it's an internal ip address that only this web application has seen and
even if you had a vpn where you could see this web application and see maybe
this range there might be firewall rules to stop you viewing this admin endpoint
so we're going to use the web application
because it's probably not firewalled because it needs to see this maybe in
another circumstance another user might be able to legitimately access this but
we're going to exploit it now so using this stock api endpoint
we're going to proxy it
we're going to just see what the parameters are so we can see
it's using all of this
i'm going to click that again and we're just going to change
to use this and 15
and that's solved the lab the carlos user has been deleted using server side
request forgery hope that all makes sense and it's probably the best i could
have explained it but again just to reiterate when you see external calls
being made to internal ip addresses or other entities
which are not the web application or api or whatever it is you're testing
think server-side requests for audrey and you'll probably have fun
thanks for watching guys