Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: SSRF with whitelist-based input filter

Ahmed | Last updated: Apr 02, 2024 01:18AM UTC

This is what I have reached so far for what happening when I provide the payload URL: http://localhost:80%2523@stock.weliketoshop.net/admin/ 1. decode the URL * http://localhost:80%23@stock.weliketoshop.net/admin/ 2. parse the URL checking for the host * username: `localhost` * password: `80%23` * host: `stock.weliketoshop.net` * path: `admin` 3. decode again (weird action) * http://localhost:80#@stock.weliketoshop.net/admin/ 4. parse to get host and path (maybe to remove the username if exist) * host: `localhost` * port: `80` * path:`admin` 5. curl to the URL * host: `localhost` * port: `80` * path: `admin` * fragment:`@stock.weliketoshop.net` What I don't understand is why it will decode the URL twice? If I'm wrong please correct me

Ben, PortSwigger Agent | Last updated: Apr 02, 2024 08:42AM UTC

Hi Ahmed, As noted in the learning material (https://portswigger.net/web-security/ssrf) some servers recursively URL-decode the input they receive and you can use this to confuse the URL-parsing code.

Ahmed | Last updated: Apr 03, 2024 02:46AM UTC