How to exploit a blind SSRF?

👩‍🎓👨‍🎓 Today, we are going to dive deeper into SSRF by exploiting a blind one using ShellShock in an example lab.
Overview:
00:00 Introduction
00:15 Checking out the webshop
00:25 Getting a request in Burp
00:50 Sending request to Repeater
01:10 Referer header
02:00 Getting Burp collaborator link
02:30 Blind SSRF
03:30 How to exploit blind SSRFs
04:00 ShellShock
05:10 Scanning internal network using Intruder
07:30 Getting RCE using ShellShock
09:00 Outro
For more information, check out blog.intigriti.com/hackademy/....
🔗 Portswigger XXS Challenge: portswigger.net/web-security/...
---
🧑‍💻 Sign up and start hacking right now - go.intigriti.com/register
👾 Join our Discord - go.intigriti.com/discord
🎙️ This show is hosted by / pinkdraconian ( @PinkDraconian ) & / intigriti
👕 Do you want some Intigriti Swag? Check out swag.intigriti.com/

[@SrRunsis]

THanks so much for this video Intigriti!!!! You guys are awesomee

[@intigriti]

Our pleasure!

[@janekmachnicki2593]

Thanks for another briliant tutorial .Great job

[@intigriti]

👊

[@hackersguild8445]

Thanks for sharing. Nice video :)

[@intigriti]

Thank you!

[@lol-hz9mc]

That's an interesting explanation!!! Thanks

[@intigriti]

Glad you liked it!

[@tudasuda5501]

Thnx!

[@intigriti]

Welcome!

[@huuloc8719]

Nice.

[@intigriti]

Thanks.

[@shpockboss3834]

On every target ,do we have to try same IP? or where can we get IP?

[@intigriti]

This is something you'd have to guess. Read up on private IP ranges and then you'll see which to scan!

[@mohmino4532]

Awesome as usual ma man 🤩 but why did u put this { foo;} ? and what is his role in this process 🙃

[@intigriti]

Thank you! The "foo" bit isn't needed, shellshock payloads often just use "() {:;}" to declare the bash function.

[@mohmino4532]

@@intigriti i see thanks again ❤

[@solo_code_rider4660]

Thanks

[@intigriti]

Welcome

[@alan.m.rebeira]

😍😍😍

[@intigriti]

😘

[@itsm3dud39]

i used other commands like id, /etc/passwd .. they are not working.why only whoami command working?

[@intigriti]

There could be a number of measures in place preventing you from running other commands.

[@jacobfurnish7450]

4:14 when you say is any host in the internal network vuln to shellshock, internal network meaning origin server or would you also have to bypass a CDN like CloudFlare or AWS in order to exploit?

[@intigriti]

Once you've found and exploited the SSRF, it's the web server scanning the internal network which is unlikely to be protected.

[@fahadfaisal2383]

This vulnerability is common is websites?

[@intigriti]

SSRFs have become quite common!

[@AnthonyMcqueen1987]

This is it time to shut them down. lol JK

[@intigriti]

👀 😋

[@MichaelCooter]

First!

[@intigriti]

🏎