> For the complete documentation index, see [llms.txt](https://chris26z.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chris26z.gitbook.io/home/write-ups/api-pentesting/ssrf.md).

# SSRF 

After interacting with the web application I discovered that the contact mechanic button or feature is weak to ssrf. To see how it is weak to ssrf let see how to on the web application is sending the contact request to the mechanic.

<figure><img src="/files/vWMW5bQxAEA6CCFxJqi4" alt=""><figcaption></figcaption></figure>

In the image below after capturing the request to the mechanic noticed there it is sending the vehicle information and help information to a url that is in a field called mechanic api. It might seems nothing but since just sending that information to a url to see that support request we can change it.

<figure><img src="/files/qNaPDjyElrNvqPV9lrJL" alt=""><figcaption></figcaption></figure>

To test if the web application is accepting any url in the mechanic api field as valid one to send vehicle help request to use any known website in this i use google.com.

<figure><img src="/files/HSDBCRLPDW9EQMPWxzpd" alt=""><figcaption></figcaption></figure>

After sending the request with using google.com instead of the intended url for the mechanic we get a 200 okay response which is can be used to further exploit this web applcation to create a web server on your localhost to can be accessed on the internet that allow to captured all help requests to your server.

<figure><img src="/files/ST4kBvBNM7u7BiM1v2jx" alt=""><figcaption></figcaption></figure>

to prevent SSRF  is good article written by OWASP : <https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/>