> For the complete documentation index, see [llms.txt](https://itrp19-notes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itrp19-notes.gitbook.io/notes/reference/hacking/port-swigger/server-side-request-forgery-ssrf/basic-ssrf-against-another-back-end-system.md).

# Basic SSRF against another back-end system

This lab has a stock check feature which fetches data from an internal system.

To solve the lab, use the stock check functionality to scan the internal `192.168.0.X` range for an admin interface on port 8080, then use it to delete the user `carlos`.

they give you some info 192.168.0.X on port 8080 and need to get to admin page to delete carlos

port 63 is open from the scans on burp intruder. nice thing about numbers is that you can run multiple scans with out hitting the scan limit.\
![](/files/XGG7AB4NDaKEX8TmHR9Q)

{% embed url="<http://192.168.0.63:8080/admin>" %}

payload to remove carlos is <http://192.168.0.152:8080/admin/delete?username=carlos>\
get the payload from right clicking the link and getting the link. or view the html code from response.