# Routing-based SSRF

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FKc5bUD0FVTdiRASSv7Nm%2Fimage.png?alt=media&#x26;token=6835a9a0-32f6-44a2-bfd4-f3eb02a7505b" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Exploitation</mark>

send any request to repeater

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FVXXfjwSG4IyYdmZT91VN%2Fimage.png?alt=media&#x26;token=6e3e5804-57e4-441f-b0b9-b86028da08a3" alt=""><figcaption></figcaption></figure></div>

open burp collaborator and copy the payload

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FGWUAvqKVryxkdMLwJKlq%2Fimage.png?alt=media&#x26;token=17603f95-6737-4d6a-903f-3481532588f2" alt=""><figcaption></figcaption></figure></div>

and now change the host header to the payload you copied from burp collaborator and send the request

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FHRnNVxZP7Yz2mEsGQheT%2Fimage.png?alt=media&#x26;token=8b250d5c-5f20-4c36-9699-a5a4daae812f" alt=""><figcaption></figcaption></figure></div>

Go back to Burp Suite’s Collaborator, and click “Poll now” for me it polled automatically

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F3S64VIUAbuf4lR3kGCMB%2Fimage.png?alt=media&#x26;token=4714bcae-d3fc-4295-84dc-aa8ef6a56c48" alt=""><figcaption></figcaption></figure></div>

In here, we received 2 DNS lookups and 1 HTTP request.

That being said, we’re able to make the website’s middleware issue requests to an arbitrary server.

**According to the lab’s background, it said:**

> To solve the lab, access the internal admin panel located in the `192.168.0.0/24` range, then delete Carlos.

So, **we can change the `Host` header’s value to `192.168.0.x`**. If we didn’t get “504 Gateway Timeout” HTTP status code, we found the internal admin panel:

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FX6oJxJQpGP1W30OJ9vHz%2Fimage.png?alt=media&#x26;token=e1a9c146-1d78-47f5-ad8e-047c7a71c0b1" alt=""><figcaption></figcaption></figure></div>

let's send this request to intruder

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F5mwDtVwvIr7G6BLp6elU%2Fimage.png?alt=media&#x26;token=92d25603-eb47-4dce-9db7-dcc1a27ea77b" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F9R51Jyi4WAItoRdcGAo4%2Fimage.png?alt=media&#x26;token=9497d701-b641-46d7-806a-caef29801d73" alt=""><figcaption></figcaption></figure></div>

when you click on start attack it will show you this warning click on ignore

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FqkklaPT0VMHAineR3QP6%2Fimage.png?alt=media&#x26;token=e18c46f2-855f-4116-a781-a37191c792ef" alt=""><figcaption></figcaption></figure></div>

click on length so we can filter the successful request

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fn6kY8zhZsaB24Eu35sfl%2Fimage.png?alt=media&#x26;token=eec7c10b-4ae5-4d80-a89f-8e00e2d250d1" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FRngYdzd250pfsHSpmoYg%2Fimage.png?alt=media&#x26;token=5ef6b299-a577-44bb-917b-4ab70cbbb2ce" alt=""><figcaption></figcaption></figure></div>

now send this request to repeater and click on follow redirection

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FPfSVYuTFPoR9DEtnrHaY%2Fimage.png?alt=media&#x26;token=b3a31a18-e641-478f-bf34-02d8b0aadccc" alt=""><figcaption></figcaption></figure></div>

now on the response right click -> show response in browser

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FfjIcjVK4ed2aHbvr0K2D%2Fimage.png?alt=media&#x26;token=ad605442-fc07-421f-823e-0c2e13c27b8b" alt=""><figcaption></figcaption></figure></div>

copy the link and paste it in the browser

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FPYv9wmWadqBM0X8kaAVe%2Fimage.png?alt=media&#x26;token=a91235e5-57a2-40cb-8daf-0b2c3be70e24" alt=""><figcaption></figcaption></figure></div>

intercept the request and write carlos in the input and click on <mark style="color:green;">**Delete user**</mark>

now in repeater change the host to the ip range we get from intruder

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FH0f7FNFtMq0yQlHwsL2Z%2Fimage.png?alt=media&#x26;token=bbb4b64d-260e-4c0b-9013-832da8d1a635" alt=""><figcaption></figcaption></figure></div>

and we have solved the challenge

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FwHfxcfNvrk6hazdGZQwa%2Fimage.png?alt=media&#x26;token=5e086b21-6584-4cae-aa01-99b338f83050" alt=""><figcaption></figcaption></figure></div>

hope you found this walkthrough easy to understand and follow

Greeting From [<mark style="color:red;">**Sayonara**</mark>](https://github.com/ismail-arame)
