In this video, we cover Lab #4 in the SSRF module of the Web Security Academy. This application's stock check feature is vulnerable to SSRF. The developer has deployed an anti-SSRF defense that will need to be bypassed. To solve the lab, we bypass the defenses and change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos. ▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬ Buy my course: https://bit.ly/30LWAtE ▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬ 00:00 - Introduction 00:14 - Web Security Academy Course (https://bit.ly/30LWAtE) 01:25 - Navigation to the exercise 02:01 - Understand the exercise and make notes about what is required to solve it 03:05 - Exploit the lab manually 12:07 - Script the exploit 21:59 - Summary 22:14 - Thank You ▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬ Python script: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/ssrf/lab-04/ssrf-lab-04.py Notes.txt document: https://github.com/rkhal101/Web-Security-Academy-Series/blob/main/ssrf/lab-04/notes.txt A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! (Orange Tsai's talk): https://www.youtube.com/watch?v=voTHFdL9S2k Web Security Academy Exercise Link: https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter Rana's Twitter account: https://twitter.com/rana__khalil