So now that we understand the theory
of server side request forgery vulnerabilities.
Let's have a basic example on how to discover it and exploit it and then
we will build up on it and cover more complex scenarios in the next lectures.
So right here we have a shop website and as usual you don't want to click on every link,
analyze the normal behavior of the website, make a list of it,
map the website and then test every single possible
value that is being sent to the website.
But obviously I don't want to waste your time.
I already know where the vulnerability is.
So I'm simply just going to click on view details on a product again,
you should be testing that, testing whatever values that are being sent.
But I already know that the check stock in
here is vulnerable to a server side request forgery.
So first of all we just want to check how this functionality works.
So for example, let's click on paris. This basically checks if this item is in stock.
We're gonna click on check stock and as a result you
get the number of items that are available in stock.
Now let's go ahead and turn on our interceptor and let's send this again
and let's analyze the data that is being sent to the web server in here.
So as you can see in here we have a few values being sent as opposed request,
you should test this for all of the vulnerabilities that we covered before,
same goes for cookies and all that.
But what I'm really interested in for this example is
the value that is being sent to the stock A.
P. I. In here.
Now this value looks a little bit strange but
if you highlight it right click click on,
convert selection and U.
R. L. Decoded. You will notice that this is simply A U. R. L.
So what's happening right now when you click on check stock in this website,
this web server that runs this website is sending another request
to the web server that is running on the following address.
Because if you compare this address to the web address in here,
you will notice that they are different.
Therefore this web server is making a server side request to the server that
is running on this address and it's asking for the product for the stock.
It's given the product I. D. And the store I. D.
Therefore simply seeing this and noticing the fact
that this web server is sending a server
side request to another server and the fact that we can actually see that in here.
So as a client we are able to modify this
to whatever server we want.
Should give you a hint that I should test this and
I should try to modify this address to a different server and
analyze the behavior of the website.
If we are able to manipulate this and get it to submit requests
to any other server other than what's specified in here,
then you have discovered a server side request forgery because you're able
to tamper with the server side request that this web server is trying to make
and you're making it do something else that it is not designed to do.
So to test, let's simply try to load local host.
Now, if you don't know what we mean by this,
basically local host is a reserved address
that will load this machine to itself.
So essentially what we're doing
right now is we're forging a request to basically load
whatever service that is loading on our own machine.
And because we did not specify a port.
So usually if you want to specify a certain part you
would put a call on followed by the port number.
But because we're not specifying a port,
we're basically loading whatever service that is
running on Port 80 in this machine.
The server machine because the server is what submitting this request, not us,
we're simply sending a forged request and then the
server is going to submit it on our behalf.
And before sending this, if you remember this was U. R. L. Encoded.
So we're actually gonna highlight it right click
convert selection and this time we're going to select U. R. L. N.
Code instead of decode
and we're gonna click on forward forward forward.
And now if you scroll down you will notice
the behavior is different.
So the default behavior we actually saw the number of units in here.
But now after we sent the first request to the
server and got to send that request on our behalf,
you noticed that we managed to actually get it to load its own website,
which is perfect.
So basically we managed to discover a server side request forgery
because we sent a forged request to this web server.
We got it to submit another request for itself.
And as a result, we're actually able to see the website being loaded within itself.