Basic SSRF against another back-end system

Let's check out the stock.

We can intercept the request using Burpsuite and send it to the Intruder.

After setting the stockAPI field to the following, we can select the payloads.

http://192.168.0.X:8080/admin

For the payload, the type is Numbers from 1-255.

Let's start the attack.

After some time we can see the only request that returned a 200 response code.

Finally, we have to send the request to the Repeater and set the stockAPI field to the following:

http://192.168.0.159:8080/admin/delete?username=carlos

We have solved the lab