Lab: SSRF with filter bypass via open redirection vulnerability

1. Visit a product, click "Check stock", intercept the request in Burp Suite, and send it to Burp Repeater.
2. Try tampering with the stockApi parameter and observe that it isn't possible to make the server issue the request directly to a different host.
3. Click "next product" and observe that the path parameter is placed into the Location header of a redirection response, resulting in an open redirection.
4. Create a URL that exploits the open redirection vulnerability, and redirects to the admin interface, and feed this into the stockApi parameter on the stock checker:
   /product/nextProduct?path=http://192.168.0.12:8080/admin
   
5. Observe that the stock checker follows the redirection and shows you the admin page.
6. Amend the path to delete the target user: /product/nextProduct?path=http://192.168.0.12:8080/admin/delete?username=carlos

Michael Sommer (no audio)