> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/ssrf/lab-2.md).
# Lab 2
So in this scenario:
```
Public web server: 203.0.113.5 (has a public IP)
Internal admin panel: 192.168.0.68 (private IP, different machine)
```
Both machines sit on the same internal network — the web server CAN reach the admin panel because they're on the same LAN, but YOU (external attacker) cannot reach 192.168.0.68 directly because private IPs aren't routable over the public internet.
The localhost is the machine itself, (127.0.0.1) and the admin panel is a private IP on the same LAN as them.
Some applications block input containing hostnames like `127.0.0.1` and `localhost`, or sensitive URLs like `/admin`. In this situation, you can often circumvent the filter using the following techniques:
* Use an alternative IP representation of `127.0.0.1`, such as `2130706433`, `017700000001`, or `127.1`.
* Register your own domain name that resolves to `127.0.0.1`. You can use `spoofed.burpcollaborator.net` for this purpose.
* Obfuscate blocked strings using URL encoding or case variation.
* Provide a URL that you control, which redirects to the target URL. Try using different redirect codes, as well as different protocols for the target URL. For example, switching from an `http:` to `https:` URL during the redirect has been shown to bypass some anti-SSRF filters.
#### Alternative IP representations
**Decimal format:**
```
http://2130706433/admin
```
(127.0.0.1 converted to a single decimal number)
**Octal format:**
```
http://0177.0.0.1/admin
```
**Hex format:**
```
http://0x7f.0.0.1/admin
```
or fully hex:
```
http://0x7f000001/admin
```
**Dropping leading zeros / shorthand:**
```
http://127.1/admin
```
We can't convert it to a HTML entity - it blocks the "#".
You can also do this in Burpsuite.