Lab: Routing-based SSRF
Summary: PortSwigger's lab demonstrates routing-based SSRF through the Host header, where replacing the Host value with an address in the 192.168.0.0/24 range lets an attacker reach an insecure intranet admin panel on an internal IP. Solving it requires sending a request to /admin/delete with a copied CSRF token and a username parameter set to carlos, using Burp Collaborator's default public server because the platform's firewall blocks interactions with arbitrary external systems.
What you should know: The Host header is attacker-controlled input that many internal networks still trust for routing, so a single request can reach an admin panel that was never meant to be internet-facing - and delete a user without any credentials.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026