> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/ssrf/lab-3.md).

# Lab 3

| Char                    | Trick                                                                                                                       |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `@`                     | Everything before `@` is creds, not host → `expected-host@evil-host` actually goes to `evil-host`                           |
| `#`                     | Everything after `#` is a fragment, never sent → `evil-host#expected-host` actually goes to `evil-host`                     |
| `.`                     | DNS subdomains read right-to-left → `expected-host.evil-host` actually goes to `evil-host`                                  |
| `%XX` / double-encoding | Filter and backend may decode at different times/depths → smuggle blocked chars past the filter, revealed on a later decode |

`stockApi=http://weliketoshop.net/product/nextProduct?currentProductId=6&path=http://192.168.0.68/admin`

You can also redirect the request towards your own domain, since the application already validates the stockApi URL is allowed. 

<figure><img src="/files/D59xNxG0CD0t2wsnRWKw" alt=""><figcaption></figcaption></figure>

Putting this in the URL does not work. Why?

\
What `path` actually does

`/product/nextProduct?path=...` isn't the SSRF entry point itself — it's a **redirect handler**. Looking at your response, you got a `302 Found` with a `Location` header pointing to exactly what you put in `path`. That means this endpoint just **redirects your browser/client** to that URL — it's a client-side redirect, not a server-side request.

* `path` parameter on `/product/nextProduct` → causes a **redirect**, fetched by your browser, which can't reach internal IPs.
* `stockApi` parameter (usually a POST to `/product/stock`) → causes the **server** to fetch the URL, which *can* reach internal IPs.

### SSRF via the Referer header

Some applications use server-side analytics software to tracks visitors. This software often logs the Referer header in requests, so it can track incoming links. Often the analytics software visits any third-party URLs that appear in the Referer header. This is typically done to analyze the contents of referring sites, including the anchor text that is used in the incoming links. As a result, the Referer header is often a useful attack surface for SSRF vulnerabilities.