Server-side Attacks Blind SSRF port scanning

HTB Content Academy
1

I have only discovered port 80 as open so far. I tried using Burp Suite and also created my own Python script, but it still shows only port 80 as open.

Am I misunderstanding the task?

Example POST request used:

POST /index.php HTTP/1.1
Host: 10.129.143.34
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
dateserver=http://10.129.143.34:{port}/index.php

1 Like
3

Hey @SanBot,
you can just use ffuf the same way it was used in the “Identifying SSRF” section.

Make sure you change the value of the filter regex -fr to the new response you get for accessing an invalid open port during the Blind SSRF :wink:

Kind regards,
Cel

1 Like