now let's continue with the same example that we have. And if we scroll down
you will notice that within the embedded website.
So when we loaded the website as the local host,
when we loaded the website with the forged request we have an
extra link in here that will direct us to the admin panel.
So in the original website you can see we only have home and my account.
But if you scroll down and look at the
website that we loaded when we sent the forest request
so when we did this right here you'll notice
we actually have an extra link that will take us
to the admin panel.
If we click on this link right here
and actually turn off our interceptors so we can go to it.
You'll notice that the website is not gonna load.
Now the error that we're getting is very informative.
So it's telling us that this page will only load if you're
logged in as admin or if requested from the loop back.
So if you requested as local host
but generally you won't get an error message that is this informative.
But if you clicked on a link and it didn't load and you were able to discover it.
Using a server side request forgery vulnerability,
then it's actually worth a shot to actually get
this server to submit that link on your behalf.
So basically exploit the S. S. R. F. Again to load whatever link you want
because similar to what I showed you earlier. If you have a server similar to this one
that contains private data, it might actually refuse direct connections to it.
But what we can do since we know that
this server is vulnerable to a server side request forgery
is send that request to the server and get the server to submit it on our behalf.
And because the server trusts this server it will actually loaded to the server.
And we will be able to see it because we are exploiting a server side request forgery.
So we're gonna turn on our interceptor,
we're gonna send a request to check the stock,
we're gonna get it to load the local host instead.
Similar to what we did in the previous example we're gonna forward it and
now we have the admin panel but we're actually not gonna click on it,
we're gonna copy its link
and then submit another request to the stock checker.
Now you could obviously do this with the repeater but
I'm just trying to keep it simple in here.
And then again we're going to go back to the stock A. P. I.
And we're gonna modify this request in here to the U. R. L.
That we just copied in here for the admin panel.
So if you even just hover over this you can see
that the admiral panel is stored at forward slash admin.
So we're simply just gonna go to http local host forward slash admin
and we're gonna have to U. R. L.
Encode all of this so you can right click and convert it
or simply press control you at the same time from your keyboard
and that's it. We're gonna forward.
And perfect now as you can see we managed
to load the admin page in here without even having
to log in because what's happening is this server is
actually the server that is loading the admin page.
So you can think of this similar to what we have to this example in here.
But instead of loading forward slash private we're loading forward slash admin
as you saw earlier.
If you submit that request as yourself you will
be denied that request because that server has a firewall
or has some strict security rules that prevented from
loading to anybody else other than this web server.
But when we managed to exploit this website
and get this web server to actually load the admin page, it loaded for the server.
And because the server is vulnerable were able
to see the admin page loading within the
vulnerable web server as you can see in here and we can actually use this page.
So as you can see this admin page doesn't really have a lot of functionality.
It only allows you to delete users but in a real world
scenario you'll be able to use whatever functionality that this admin page offer
now similar to what happened when we clicked on the admin panel and it did not load
any functionality that you see in here will not work directly from your
browser because remember any request you send to that server will be denied.
You will have to forge your request so that
the web server submits that request on your behalf.
For example if I wanted to delete the user Carlos
or winner in here I can't send that request.
As is
I'm going to have to right click
copy the link address
and then make sure my interceptor is on,
click on check stock again or use the repeater like
I said earlier remove everything that I have in here,
paste the U.
R. L. That I copied and make sure I changed the domain in here to local host
as we said earlier.
So we're getting the server to submit this request to itself and make sure the U. R. L.
Encode all of this control you and then send it and now notice once we send it,
user Carlos should disappear.
So let's go ahead and send it now.
It's telling us it could not fetch stock level but that's fine.
Let's go ahead and load the page again to see if Carlos did actually get removed.
So we're just gonna do local host
admin
U. R. L. Encoded and send it.
And perfect as you can see
it's telling us that the user was deleted successfully and
Carlos is deleted and we can only see winner.
So we basically first of all managed to communicate with a server
that we're not supposed to communicate with because it's got security.
We also managed to load a page that we're not supposed to see.
And we even managed to do delete a user that is stored on the server.
And all of that was possible because we're
actually sent in forged requests and getting a
Web server that is trusted by the target
server to submit these requests on our behalf.