# SSRF vulnerability

On the _**/admin/api**_ page (_**“API”**_ from dashboard), there appears to be admin instructions for us to retrieve sensitive credentials:

<figure><img src="https://667177664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMsAGomcNx5xaB1xFygc9%2Fuploads%2F1EIG8VHcjDi675Z8uDwP%2Fimage.png?alt=media&#x26;token=7b81ce25-4f53-423d-bc39-f08fecd9d131" alt=""><figcaption></figcaption></figure>

While on the _**/admin/settings**_ page (_**“Settings”**_ from dashboard), there appears to be a form for us to enter a URL. This hints us to change the URL to the localhost addresses given to us from the API page. From there, we will be able to retrieve a base64 encoded string of the sensitive content. We can use the terminal to decode the base64 encoded string:

```sh
$ echo <base64_string> | base64 -d
```

This simple example demonstrates a Server-Side Request Forgery (SSRF) vulnerability, where we are able to manipulate requests made on the server-side to internal addresses, to upload/retrieve information that we are otherwise not allowed to.



