Lab: SSRF via flawed request parsing
Summary: PortSwigger's lab demonstrates routing-based SSRF caused by flawed parsing of a request's intended host, letting an attacker reach an insecure intranet admin panel at an internal IP in the 192.168.0.0/24 range. Solving it requires pointing an absolute URL in the request line at /admin/delete, copying the CSRF token from the response, and adding it with a username parameter set to carlos to delete that user.
Bottom line: The middleware here will issue requests to whatever host the request line names, so an internal admin panel that assumes it is unreachable from outside becomes reachable through the front door.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026