Blind SSRF with Out-of-Band Detection: Step-by-Step Exploitation & Prevention  —  SSRF Labs

1. Open the SSRF Lab and select any product from the list

2. Go back to Burp Suite and navigate to the HTTP History tab

3. Locate the request containing GET /product?productId=1, right-click, and send it to the Repeater tab

4. Modify the Referer header and observe the response

5. Next, test for out-of-band interaction using Burp Collaborator by replacing the Referer header with a unique Burp Collaborator-generated URL

6. Switch to the Collaborator tab and click Poll Now to check for interactions

7. If there is an interaction (either HTTP or DNS requests), it confirms that the server processed the external request

8. This interaction indicates that the application is vulnerable to Blind SSRF

9. Go back to the browser, refresh the page, and confirm that the lab challenge has been successfully solved