# Introduction to Web Hacking: Intro to SSRF (TryHackMe)

This article will cover the [Intro to SSRF](https://tryhackme.com/room/ssrfqi) write-up under the Web Fundamentals on THM.

## What is an SSRF?

**What is an SSRF?**

SSRF stands for Server-Side Request Forgery. It's a vulnerability that allows a malicious user to cause the webserver to make an additional or edited HTTP request to the resource of the attacker's choosing.

**Types of SSRF**

There are two types of SSRF vulnerability; the first is a regular SSRF where data is returned to the attacker's screen. The second is a Blind SSRF vulnerability where an SSRF occurs, but no information is returned to the attacker's screen.

## **What's the impact?**

A successful SSRF attack can result in any of the following:

* Access to unauthorised areas.
    
* Access to customer/organisational data.
    
* Ability to Scale to internal networks.
    
* Reveal authentication tokens/credentials.
    

**Answer the questions below**

1. What does SSRF stand for? `Server-Side Request Forgery`
    
2. As opposed to a regular SSRF, what is the other type? `Blind`
    

## SSRF Examples

Click the **View Site** button, which will take you through some common SSRF examples, how to exploit them, and even a simulation to see if you can take advantage of an SSRF vulnerability using what you've learned.

**Answer the questions below**

1. What is the flag from the SSRF Examples site? `THM{SSRF_MASTER}`  
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739620595214/8edad63d-675c-4922-ad54-69f563e09640.png align="center")
    

## Finding an SSRF

Potential SSRF vulnerabilities can be spotted in web applications in many different ways. Here is an example of four common places to look:

**When a full URL is used in a parameter in the address bar:**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/956e1914b116cbc9e564e3bb3d9ab50a.png align="center")

**A hidden field in a form:**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/237696fc8e405d25d4fc7bbcc67919f0.png align="center")

**A partial URL such as just the hostname:**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/f3c387849e91a4f15a7b59ff7324be75.png align="center")

**Or perhaps only the path of the URL:**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/3fd583950617f7a3713a107fcb4cfa49.png align="center")

Some of these examples are easier to exploit than others, and this is where a lot of trial and error will be required to find a working payload.

If working with a blind SSRF where no output is reflected back to you, you'll need to use an external HTTP logging tool to monitor requests such as [requestbin.com](http://requestbin.com), your own HTTP server or Burp Suite's Collaborator client.

Answer the questions below

Based on simple observation, which of the following URLs is more likely to be vulnerable to SSRF? `3`

1. [`https://website.thm/index.php`](https://website.thm/index.php)
    
2. [`https://website.thm/list-products.php?categoryId=5325`](https://website.thm/list-products.php?categoryId=5325)
    
3. [`https://website.thm/fetch-file.php?fname=242533.pdf&srv=filestorage.cloud.thm&port=8001`](https://website.thm/fetch-file.php?fname=242533.pdf&srv=filestorage.cloud.thm&port=8001)
    
4. [`https://website.thm/buy-item.php?itemId=213&price=100&q=2`](https://website.thm/buy-item.php?itemId=213&price=100&q=2)
    

## Defeating Common SSRF Defenses

More security-savvy developers aware of the risks of SSRF vulnerabilities may implement checks in their applications to make sure the requested resource meets specific rules. There are usually two approaches to this, either a deny list or an allow list.

**Deny List**

A Deny List is where all requests are accepted apart from resources specified in a list or matching a particular pattern. A Web Application may employ a deny list to protect sensitive endpoints, IP addresses or domains from being accessed by the public while still allowing access to other locations. A specific endpoint to restrict access is the [localhost](http://localhost), which may contain server performance data or further sensitive information, so domain names such as [localhost](http://localhost) and 127.0.0.1 would appear on a deny list. Attackers can bypass a Deny List by using alternative [localhost](http://localhost) references such as 0, 0.0.0.0, 0000, 127.1, 127.\*.\*.\*, 2130706433, 017700000001 or subdomains that have a DNS record which resolves to the IP Address 127.0.0.1 such as [127.0.0.1.nip.io](http://127.0.0.1.nip.io).

Also, in a cloud environment, it would be beneficial to block access to the IP address 169.254.169.254, which contains metadata for the deployed cloud server, including possibly sensitive information. An attacker can bypass this by registering a subdomain on their own domain with a DNS record that points to the IP Address 169.254.169.254.

**Allow List**

An allow list is where all requests get denied unless they appear on a list or match a particular pattern, such as a rule that an URL used in a parameter must begin with [**https://website.thm**](https://website.thm)**.** An attacker could quickly circumvent this rule by creating a subdomain on an attacker's domain name, such as [https://website.thm.attackers-domain.thm](https://website.thm.attackers-domain.thm). The application logic would now allow this input and let an attacker control the internal HTTP request.

**Open Redirect**

If the above bypasses do not work, there is one more trick up the attacker's sleeve, the open redirect. An open redirect is an endpoint on the server where the website visitor gets automatically redirected to another website address. Take, for example, the link [https://website.thm/link?url=https://tryhackme.com](https://website.thm/link?url=https://tryhackme.com). This endpoint was created to record the number of times visitors have clicked on this link for advertising/marketing purposes. But imagine there was a potential SSRF vulnerability with stringent rules which only allowed URLs beginning with [https://website.thm/](https://website.thm/). An attacker could utilise the above feature to redirect the internal HTTP request to a domain of the attacker's choice.

**Answer the questions below**

1. What method can be used to bypass strict rules? `Open Redirect`
    
2. What IP address may contain sensitive data in a cloud environment? `169.254.169.254`
    
3. What type of list is used to **permit** only certain input? `Allow List`
    
4. What type of list is used to **stop** certain input? `Deny List`
    

## SSRF Practical

Let's put what we've learnt about SSRF to the test in a fictional scenario.

We've come across two new endpoints during a content discovery exercise against the **Acme IT Support** website. The first one is **/private**, which gives us an error message explaining that the contents cannot be viewed from our IP address. The second is a new version of the customer account page at **/customers/new-account-page** with a new feature allowing customers to choose an avatar for their account.

Begin by clicking the **Start Machine** button to launch the **Acme IT Support** website. Once running, visit it at the URL [https://LAB\_WEB\_URL.p.thmlabs.com](https://lab_web_url.p.thmlabs.com/) and then follow the below instructions to get the flag.

First, create a customer account and sign in. Once you've signed in, visit [https://LAB\_WEB\_URL.p.thmlabs.com/customers/new-account-page](https://lab_web_url.p.thmlabs.com/customers/new-account-page) to view the new avatar selection feature. By viewing the page source of the avatar form, you'll see the avatar form field value contains the path to the image. The background-image style can confirm this in the above DIV element as per the screenshot below:

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/bd9ee9ac0b7592b5343cbc8dd9b57189.png align="center")

If you choose one of the avatars and then click the **Update Avatar** button, you'll see the form change and, above it, display your currently selected avatar.

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5c549500924ec576f953d9fc/room-content/8685bf7a4b24616031425a7f5e8db1ae.png align="left")

Viewing the page source will show your current avatar is displayed using the data URI scheme, and the image content is base64 encoded as per the screenshot below.

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/fff0ea113602635dcf5d1e8d0b1d8bca.png align="center")

Now let's try making the request again but changing the avatar value to **private** in hopes that the server will access the resource and get past the IP address block. To do this, firstly, right-click on one of the radio buttons on the avatar form and select **Inspect**:

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/2ef87608418e47625bedad9d0361ed08.png align="center")

**And then edit the value of the radio button to private:**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/a1712298679cc642d792d935b14effe5.png align="center")

Be sure to select the avatar you edited and then click the **Update Avatar** button. Unfortunately, it looks like the web application has a deny list in place and has blocked access to the /private endpoint.

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/a59460cc19eaf5776ee8a882e25b2d64.png align="center")

As you can see from the error message, the path cannot start with /private but don't worry, we've still got a trick up our sleeve to bypass this rule. We can use a directory traversal trick to reach our desired endpoint. Try setting the avatar value to **x/../private**

![](https://tryhackme-images.s3.amazonaws.com/user-uploads/5efe36fb68daf465530ca761/room-content/84b88d9c6fa6a29450520625bb42870d.png align="center")

You'll see we have now bypassed the rule, and the user updated the avatar. This trick works because when the web server receives the request for **x/../private**, it knows that the **../** string means to move up a directory that now translates the request to just **/private**.

Viewing the page source of the avatar form, you'll see the currently set avatar now contains the contents from the **/private** directory in base64 encoding, decode this content and it will reveal a flag that you can enter below.

**Answer the questions below**

1. What is the flag from the /private directory? `THM{YOU_WORKED_OUT_THE_SSRF}`
    
    Following the guide above you’ll need to create a new account then navigate to **/customers/new-account-page** which will show you some avatars and you’ll select the 6th one and update the avatar. Once you’ve updated you’ll try to change the HTML affecting inspecting the page. You’ll update the value of the input to be `private` then select the 6th as the avatar, and then have `x/../private` as the input value then also update the avatar as the 6th one.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739561242349/3e9fba6b-6f29-457c-be9c-310525feec48.png align="right")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739555797929/14bc75a4-e7e6-49be-b3da-855b891af4f5.png align="center")
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739620183483/211936ec-bb3a-4188-afdc-54150157433c.png align="center")

copy the base64-encoded string shown under the current avatar’s background image after using the input value as x/../private, which successfully updates the avatar and when you switch to this URL [https://IP\_ADDRESS.p.thmlabs.com/customers/new-account-page?success=/private](https://10-10-187-205.p.thmlabs.com/customers/new-account-page?success=/private), you’ll be able to find then you’ll decode it using the [base64decode](http://base64decode.org) site

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739620527729/23759c94-6a7f-40e8-b235-3cac3110f9a9.png align="center")

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the Lab THM challenges.