in this class.
We're going to use the intruder functionality
of Burp suite to discover the clients that
are connected to the same network as
the web server hosting the vulnerable web application
and the services running in these clients.
So right here we have another shop website.
It's not exactly the same as the previous one as
usually want to test every single functionality in here,
but I already know what's vulnerable and it is the
stock checking functionality in here similar to the previous example.
So running a normal test as you can see,
gets you the number of units available of this product in stock.
We're gonna go ahead and turn on the interceptor, send the request again.
And as usual again, you want to test everything in here.
But what we're interested in here is this part of the request and again,
if we right click it and decode it,
you'll notice that this is a request that is being sent to a different U. R. L.
And again comparing this U R. L. To the U. R. L.
That we see in here, we can see that this is a different U. R. L.
And therefore we conclude that this server that is hosting this website is
actually sending this request to another server to get data from it.
And therefore this is a server side request.
And as users were able to modify this request in any way, shape or form,
then that means we're able to forge requests and send them
on behalf of this web server to other web servers.
And therefore that means we have discovered a server side
request forgery vulnerability and we are able to exploit it.
In the previous example we changed the RL
here to local host to load whatever web server
that is loading on the current server that that
has the web server application installed on it.
But in this example if you look at the RL you'll notice that this is an internal I. P.
I know this is an internal I. P. Because it's actually a reserved I. P.
That can only be used in internal networks. So if you look up internal I. P.
S you'll see a number of examples and one of them is 19216801.
Now what you see in here after the I. P.
After the colon is deport that this request is being sent to.
So it's being sent to this address to this sport.
If you don't specify the ports similar to what we did in the previous example
then the data is sent to the default sport which is part 80.
But in this example as you can see there is specifically specifying port 80 80
and therefore this data or this request is going to be sent to this I.
P. On port 80 80.
Now let's first of all verify that this web
server is vulnerable to a server side request forgery.
And then if we do manage to discover the vulnerability we'll see how we can
modify this request to discover all of the clients connected to the same network.
So to just verify that this is vulnerable.
We're gonna need to modify this request and see if that request gets submitted.
So let's send this to the repeater.
And in here
let's keep this simple and remove all of this. Highlight the U R L
U R L. Encoded
and send it.
So basically just trying to see if we're able to modify the original request,
send it and actually get a response for it because if we can
do that then we actually have a server side request forgery vulnerability.
And then from there we'll see the impact and see what we can do with it.
But the bottom line is we are able to modify
the request and have the server submitted on our behalf.
And as you can see when we sent this request we actually got a violent http response.
It's simply telling us there is missing parameters.
Which makes sense because we actually removed
everything that came after the forward slash
now because we know that this range right here.
The 19216801 is arranged for internal I PS
Let's simply try to increase this I. P. Instead of one.
Let's just change it to something else that is still valid like two.
And send the request. As is
Now as you can see the request we got now is significantly different.
It's basically a 500 internal error. And if we actually render the response
you'll see that it's telling us could not
connect to the external stock check service.
So basically it's telling us that this I. P. Right here. 19216801.
We're not able to connect to it at all.
It's as if there is nothing running on this
address on the specified ports which is 80 80.
Whereas when we when we requested one
and sent the request as you can see it's simply telling us missing parameter.
So it's able to connect this to this I. P.
It's able to connect to this part but it's missing something
because we actually removed everything that comes out of this.
Therefore by simply modifying this request and increasing the number in here.
From 1 to 2 to three all the way up to the end of the range which is 254.
We will be able to discover all of the internal I. P. S.
So all of the internal computers connected to the
same network as the server hosting the vulnerable application.
And then we can even change the 80 82 whatever ports
that we are trying to discover on the target computers.
We can actually do all of that using burps intruder. Just keep watching to learn how