TryHackMe - Intro to SSRF

Task 1

What does SSRF stand for?

Server-Side Request Forgery

As opposed to a regular SSRF, what is the other type?

Blind

Task 2

since without & the server was requesting https://server.website.thm/flag?id=9.website.thm/api/item?id=2 we can use & to specify another parameter to get rid of wrong id passed.

Task 3

Based on simple observation, which of the following URLs is more likely to be vulnerable to SSRF?

1. https://website.thm/index.php
2. https://website.thm/list-products.php?categoryId=5325
3. https://website.thm/fetch-file.php?fname=242533.pdf&srv=filestorage.cloud.thm&port=8001
4. https://website.thm/buy-item.php?itemId=213&price=100&q=2

since the 3rd website makes a request to file-storage server its more likely to be vulnerable to ssrf ans - 3

Task 4

What method can be used to bypass strict rules?

open redirect

What IP address may contain sensitive data in a cloud environment?

in cloud we can leak credentials something like this /fetch?url=http://169.254.169.254/latest/meta-data/ answer : 169.254.169.254

What type of list is used to permit only certain input?

allow list

What type of list is used to stop certain input?

deny list

Task 5

What is the flag from the /private directory?

so after creating a new account and visiting /customers/new-account-page we try to change the avatar

it makes a post request with form data avatar=assets%2Favatars%2F2.png we can try to change the value and try to access /private we get an error

    <div class="alert alert-danger text-center">
                            <p>URL cannot start with /private</p>
                        </div>

but we can start our url with something else and still use path traversal techniques to get to /private

<div class="avatar-image" style="background-image: url(data:image/png;base64,VEhNe1lPVV9XT1JLRURfT1VUX1RIRV9TU1JGfQ==)"></div>

we have our updated avatar now we can decode it and get our flag THM{YOU_WORKED_OUT_THE_SSRF}