---
description: >-
  https://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/ssrf-apprentice/ssrf/lab-basic-ssrf-against-localhost
---

# Basic SSRF against the local server

## Description

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, change the stock check URL to access the admin interface at `http://localhost/admin` and delete the user `carlos`.

## Solution

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FciwqrHGQpJf5zFswdwQy%2Fimage.png?alt=media&#x26;token=4ab9bb48-9f71-44fa-8fe2-0d7a6fcd0bda" alt=""><figcaption></figcaption></figure>

Every product has a dedicate check function to retrieve if a product is availble or not:

value="http://stock.weliketoshop.net:8080/product/stock/check?productId=1\&storeId=1"

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FKxi7HkdjoexKRWb8Q5vH%2Fimage.png?alt=media&#x26;token=846642ac-7438-4ab4-b3d1-80217ca5077c" alt=""><figcaption></figcaption></figure>

clicking to "Check stock" button we obtain the number of pieces in stock

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F7mznqcKn1il1311cZozy%2Fimage.png?alt=media&#x26;token=128430f0-0151-497d-b5ea-7f00ca3dfb5c" alt=""><figcaption></figcaption></figure>

We can change the stock check URL to access the admin interface inseriting the stockApi value selecting it and updating it into Inspector field at `http://localhost/admin`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FRQMZh0zFRYmoFIC4dJJD%2Fimage.png?alt=media&#x26;token=89c1da0c-c2f3-476b-b020-97c64bee2a0d" alt=""><figcaption></figcaption></figure>

In this way we're able to access in the admin panel via a SSRF,  and checking into the reponse there're links for deleting users Wiener and Carlos:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F0oGknJZrqJickewBoivL%2Fimage.png?alt=media&#x26;token=23ecd4e4-3b5c-43ae-ac9a-cb05c2701312" alt=""><figcaption></figcaption></figure>

The scope of the lab is to delete Carlos user, we can do it inserting the deletion link into stockApi value and solving the lab:

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FF0ScY7QVGmQqjGzU0sDE%2Fimage.png?alt=media&#x26;token=361f8f16-562c-4833-b31b-ba820be364c3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FNqV3YN3eMNVTg5yRKJJ3%2Fimage.png?alt=media&#x26;token=b25a044a-f42b-4090-bb33-3b1cc798c63f" alt=""><figcaption></figcaption></figure>
