# SSRF 0x01

First try the application

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FrWdWwo7hjxTLaPvJUqS8%2Fimage.png?alt=media&#x26;token=2842e4c7-9620-4c01-8a0c-ce7e693c87b7" alt=""><figcaption></figcaption></figure>

Looks like the request is communicating with api&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F4iyMer9AC2QlQKVe84KK%2Fimage.png?alt=media&#x26;token=d520e8b0-4406-4d94-82a9-77a4fed1ee77" alt=""><figcaption></figcaption></figure>

We can see that we have admin.php in that api directory but 403 request means we cant access

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FRARfIR9lG6pn49v9U0wi%2Fimage.png?alt=media&#x26;token=26e3e0e7-ac6c-4bc3-a29c-df65659c6280" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FTALcOvP5hsJxuw4yMI2Q%2Fimage.png?alt=media&#x26;token=f1067c4d-8160-4ee0-9e64-e20870cddbbd" alt=""><figcaption></figcaption></figure>

But when we manipulate the request now we can actually access the admin.php

through the application that is communication with api

now we can find for some localhost file or something

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FLadsjCmPkqlC71bTUgR2%2Fimage.png?alt=media&#x26;token=fdc56252-abfb-48e6-9331-9042614c5af2" alt=""><figcaption></figcaption></figure>
