> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/server-side-request-forgery-ssrf/basic-ssrf-against-another-back-end-system.md).
# Basic SSRF against another back-end system
https\://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-backend-system
Let's check out the stock.
We can intercept the request using Burpsuite and send it to the `Intruder`.
We do not know the IP address of the back-end system. We can find it by fuzzing all the IP addresses in the network.
Let's set the `stockApi` parameter to the following:
```
http://192.168.0.X:8080/admin
```
For the payload, the type is `Numbers` from 1-255.
Let's start the attack.
After some time we can see the only request that returned a `200` response code is the one where the last field is `59`.
This means that the IP address of the backend system is `192.168.0.59`.
Finally, we have to send the request to the `Repeater` and set the `stockAPI` parameter to the following:
```
http://192.168.0.159:8080/admin/delete?username=carlos
```
We have solved the lab
