> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssrf-lab/lab-6.md). # lab-6 ## Blind SSRF with Out-of-Band Detection **Difficulty:** Practitioner ### Lab Description This site uses analytics software which fetches the URL specified in the `Referer` header when a product page is loaded. **Objective:** Use this functionality to cause an HTTP request to the public Burp Collaborator server. ### Root Cause Some application servers make outbound requests but never reflect the response back to the client — this is known as **blind SSRF**. Even though no output is returned, the vulnerability still exists. It can be confirmed and exploited using out-of-band techniques: the attacker supplies a URL they control (such as a Burp Collaborator domain), and the back-end server makes a request to it. The incoming request to the attacker's server confirms the SSRF, even with no visible response in the application. ### Exploitation 1. Access any product page and capture the request in Burp. 2. Find the `GET /product?productId=1` request and send it to Repeater. 3. Update the `Referer` header to your Burp Collaborator URL: ``` Referer: https://YOUR-COLLABORATOR-ID.oastify.com ``` 4. Send the request, then switch to the **Burp Collaborator** tab and click **Poll now**. 5. When HTTP and DNS interactions appear in Collaborator, the blind SSRF is confirmed and the lab is complete. ### Lesson Learned * Back-end application servers must never blindly trust user-controlled URL parameters — including HTTP headers such as `Referer`. * The server should never make outbound requests to external, unregistered URLs based on client-supplied input. * Blind SSRF is just as dangerous as reflected SSRF — the absence of a visible response does not mean the vulnerability cannot be exploited for data exfiltration, internal network scanning, or further attack chaining. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssrf-lab/lab-6.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.