1

I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?

Improve this question
1

1 Answer 1

Reset to default
1

I think SSRF vulnerability is actually used to gain information regarding the internal network and machines which otherwise are not accessible to outside world. Assuming the webserver which suffers from this vulnerability is inside a DMZ, then using SSRF you can perform port scan and know the status of ports and services running on those internal machines. When you say external IP(another computer on network) I assume you refer to other machine/host which is in the same network of that of the machine that host the webserver. In this case yes you can perform port scanning of that machine.

Improve this answer
1
  • If you want to know the IP address of another computer on that network using SSRF, i think that's not possible. But you can try a brute force kind of approach if you know the IP address of the webserver and then trying to give all the IPs by incrementing the last octet value. Also if you have a SSRF vulnerable Post body parameter containing value as the machine name or IP address somewhere going in the request.
    – srinivas karthik
    Apr 29, 2017 at 11:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .