Lab: Basic SSRF against another back-end system
Summary: PortSwigger's Web Security Academy lab presents a stock check feature that fetches data from an internal system, and the exercise is to use it to scan the 192.168.0.X range on port 8080 for an admin interface. The solution intercepts the stockApi parameter, runs a Burp Intruder numbers payload from 1 to 255 with a step of 1, sorts results by status code to find the single 200 response, then sends /admin/delete?username=carlos through the same parameter.
Bottom line: The attack needs no exploit code: a single stockApi parameter that accepts a URL is enough to walk an internal 192.168.0.X network and reach an admin interface on port 8080 that was never meant to be exposed. Any server-side feature that fetches a user-supplied URL is a path into the internal network.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026