Writeup: Blind SSRF with out-of-band detection

Lab link.

Blind SSRF occurs when an application can be encouraged to send a back-end HTTP request to a given URL, but the response from the back-end request is not returned in the application’s front-end response. Using Burp Collaborator we can create unique domains and send them as payloads to the application. We can monitor if there is any interaction in this domain.

Leave a Reply

Your email address will not be published. Required fields are marked *