# Blind SSRF with Shellshock Exploitation - PortSwigger Lab Walkthrough

### Introduction

**Server-Side Request Forgery (SSRF)** is an attack where an attacker tricks a vulnerable server into making unintended requests to internal or external systems.

In this blog, we will explore how to exploit a **Blind Server-Side Request Forgery (SSRF)** vulnerability combined with **Shellshock** in a PortSwigger Academy lab. Our objective is to exploit an analytics feature to access an internal server and extract the OS username using Shellshock.

**What is Shellshock?**

**Shellshock (CVE-2014-6271)** is a vulnerability in Bash that allows remote code execution (RCE) through environment variables in HTTP headers like *User-Agent*, *Referer,* or *Cookie.*

### Step-by-Step Walkthrough

**Step 1: Identifying the SSRF Entry Point**

1. Open **Burp Suite** and intercept a request while browsing the product page.
    
2. Look for the Referer header— this is the SSRF injection point.
    
3. Modify it to test an internal IP:
    
    `Referer: http://192.168.0.1:8080/`
    
4. Send the request and check if you receive a response. if not, try `192.168.0.2, 192.168.0.3`, etc.
    

**Step 2: Injecting Shellshock payload**

Once we find the internal server, we exploit it using Shellshock. Modify the Referer header to:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742626764536/2b0fd86e-a0a1-48c6-afb7-ab802f1490df.png align="center")

**Step 3: Extracting the OS Username**

1. Go to **Burp Collaborator** and check for incoming interactions.
    
2. If successful, you will see a request containing the OS username from the internal server.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742626920314/cea7acc7-afe2-4ec7-9ce0-c7fdbca77eeb.png align="center")
    

### Mitigation

To prevent such attacks, developers should:

1. Restrict internal network access from public-facing application.
    
2. Validate and sanitize user inputs, especially header like Referer.
    
3. Use a firewall to block unnecessary outbound traffic.
    

### Conclusion

This lab showcases how **SSRF** can be used to reach an internal service and escalate privileges using **Shellshock**. By chaining these two vulnerabilities, an attacker can gain unauthorized access to sensitive information.