> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/ssrf.md).

# SSRF

![](/files/-MekanpWkz3I31r_kpWq)

## What is SSRF?

![](/files/-Mekb6tO7-dVK3Gcx_Cb)

## Cause of the Vulnerability

![](/files/-MekbZr6OQIdmdMGEi2b)

![](/files/-MekboLZyctlpagd66KX)

## SSRF Payload

![](/files/-Mekc18iLpxi0HKFNuIl)

![](/files/-MekcGQJbgIVkt-TEM0P)

![](/files/-MekcOtRpaAm0KEHaebY)

![](/files/-MekcXv_zO26vinmkwD-)

## Exercise

![](/files/-MekciO-JKrXxVviZuSA)

Lets check the webpage

![](/files/-MekcvDeZ2T0F8nxSkjn)

After doing a number of check, we can write a simple bash script that will give us the answer.

![](/files/-MekdncdYt2JjDJjZ5fm)

![](/files/-MekipSW2ouhIucj5mF4)

After a while, it shows that 5 ports are open

![](/files/-Mekiw42dqUDjhnSn7lc)

We can find out how many users there are by looking at the /etc/passwd file

![](/files/-MekjFyrHkq6hFOWdwpA)

Lets go to the source code

![](/files/-MekjSymzGGeLeDDv5Oc)

![](/files/-MekjXTkvkryXl8WgND9)