Basic SSRF Against the Local Server

• The objective of this lab is to perform server-side request forgery (SSRF) by altering the URL so that the HTTP request is made back to the server via its loopback network interface. You then need to delete the user carlos.
• The lab gives access to a shopping site as shown below.

• The instructions for this lab is to alter the stock check URL to access the admin interface at http://localhost/admin. Click on any of the items, change the location and then click on Check stock and capture this request on BurpSuite Proxy.

• Now, edit the stockApi to http://localhost/admin. Once you forwrad this request, you’ll see that the Admin panel now appears at the bottom of the page.

• However, deleting the user carlos is not possible from here as you get the message below;

• Take note of the GET request on Proxy when you try to delete the user carlos. This request will be edited so that it is made directly to the admin panel from localhost. Now, go back to home, click on an item, check the stock and capture this request.

• Once you forward this request, user carlos is deleted and you get the message;