# Lab: SSRF with blacklist-based input filter We have here the same functionality as the other exercises. A check stock functionality which has a parameter that connects to a internal system. In this case, the tester has to bypass a filter.

Checking the stock. throws the following request

If we use a basic one, the response shows us a message error

Let's enum possible bypasses from portswigger: I use the entire list

And we can see 2 http 200 code

The payload is "//127.1" or "//127.0.1" From there we intercept the request and pass it the payload and we can see the admin panel, and from there deleting the user "carlos"

It seems that has another filter... Let see if we encode "admin" uri

It seems it's not working... Let's try if double encoding works

Yes! It worked. We can see the admin panel where you can delete user "carlos"