0

I am working on some portswigger labs to get good at web security. I was doing this lab at the following link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost

Spoiler, you press the "check stock" button on one of the item posts, and then find the Post request that was picked up by Burp Suite Proxy, where the server sent a query to another server with stock information.

This seems to imply that Burp Proxy somehow is able to intercept the packets sent by the server, even though they have nothing to do with the client. How is this possible, since I thought that Burp Proxy only intercepts traffic between the client and server, and not between the server and elsewhere?

The answer I came up with so far is that this is part of the vulnerability in the app, that the server sends back information to the client, but I'm not sure this really is the case.

Any help would be appreciated!

2
  • 1
    welcome - you could try inspecting browser activity using the dev tools? if you're not aware of this , try ctrl + shift + i or f12 .. if there is any redirect or background request in play then it will show up in the network tab
    – brynk
    Commented Apr 9 at 10:05
  • 1
    Your browser sends a request (1) to the server which sends request (2) to the other server. Burp is able to intercept request 1, but not request 2.
    – paj28
    Commented Apr 9 at 10:38

1 Answer 1

1

As brynk mentioned in the comments, I checked in the dev tools and saw that indeed it is the client that makes the request, since when you press the check stock button, the js code in the webpage initiates the request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .