🕸️ OWASP Top 10 Lab — SSRF Backend Injection & Security Misconfiguration

Category: A10: SSRF & A02:Security Misconfiguration

🧠 Vulnerability Type

• Server-Side Request Forgery (Partial SSRF)
• Backend route injection
• Verbose stack trace disclosure

🎯 Objective

Demonstrate how injecting user-controlled URLs into backend route parameters can trigger SSRF-like behavior and expose internal application implementation details.

🛠 Lab Environment

• OWASP Juice Shop (Docker)
• Burp Suite Community Edition
• Kali Linux (UTM)

👣 Steps to Reproduce

1. Capture a valid request from the Track Order feature.
2. Send the request to Burp Repeater.
3. Modify the endpoint with a URL payload:

GET /rest/track-order/http://localhost:3000/ftp

4. Send the modified request and observe the server response.

💥 Impact

• Internal application architecture disclosure
• Technology fingerprinting (Node.js, Express, Angular)
• Expanded attack surface for targeted exploitation
• Potential gateway for deeper SSRF exploitation

🧪 Proof of Concept

Injecting a URL inside a backend route parameter caused the application to mis-handle input and return verbose error responses containing stack traces and internal paths.

Injected SSRF Payload via Burp

500 Internal Server Error Response

Verbose Stack Trace Disclosure

🛡 Mitigation

• Strict validation of route parameters
• Block URL-based input injection
• Disable verbose stack traces in production
• Implement centralized error handling
• Use allowlists for backend URL resolution

🧠 Key Learning

Even partial SSRF behavior can expose valuable reconnaissance data. Verbose error messages dramatically increase risk by revealing internal architecture, routing logic, and technology stack.

🐺 Personal Note

This lab demonstrates how backend injection does not always require full SSRF exploitation to be impactful. Information disclosure through stack traces can significantly aid attackers in chaining deeper vulnerabilities.