A somewhat curated list of links to various topics in application security.
| Link | Excerpt |
|---|---|
| SSRF Series | SSRF (Server-Side Request Forgery: server-side request forgery) is a fake exploit server-initiated requests. Generally, SSRF attacks target internal systems that are not accessible from the external network. 1. Show response to attacker (basic) 2. Do now show response (blind) |
| Server Side Request Forgery (SSRF) | |
| AllThingsSSRF | This is currently work in progress I will add more resources as I find them. Detectfy - What is server side request forgery (SSRF)? |
| Escalating SSRF to Accessing all user PII information by aws metadata | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to leaked all user PII information by SSRF aws metadata exploitation. Don’t go outside without any reason . Stay home be safe and also safe other. |
| SSRF Cross Protocol Redirect Bypass · Doyensec's Blog | Server Side Request Forgery (SSRF) is a fairly known vulnerability with established prevention methods. So imagine my surprise when I bypassed an SSRF mitigation during a routine retest. |
| Mitigating SSRF in 2023 | Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to trick a server-side application to make a request to an unintended location. SSRF, unlike most other specific vulnerabilities, has gained its own spot on the OWASP Top 10 2021. |
| CodeNinja | Posted on June 27, 2021 |
| Useful Mind Maps | Useful Mind Maps Collection 1. IDOR Techniques 2. Testing 2FA 3. 2FA Bypass Techniques 4. Bugs in Register/ Signup Feature 5. Cookie_Based_Authentication_Vulnerabilities 6. SSRF 7. Tesing JIRA for CVE’s 8. OAUTH2 Pentesting Checklist 9. Testing OAUTH 10. |
| The story of how I was able to chain SSRF with Command Injection Vulnerability | Hope you’re doing well, I am Raj Qureshi and I am a penetration tester. today I am doing another write-up about one of my best findings ever. In this write-up, I will be describing how I was able to chain SSRF attack with command injection Vulnerability. |
| SSRF’s up! Real World Server-Side Request Forgery (SSRF) | In this blog post we’re going to explain what an SSRF attack is, how to test for it, and some basic guidelines on how to fix it. We will be using a real-world example, exploiting a vulnerability we discovered in a commercial Business Intelligence product called Dundas BI. |
| Server Side Request Forgery | Server-side request forgery (or SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. |
| A Pentester’s Guide to Server Side Request Forgery (SSRF) | What is SSRF? In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL, which the code running on the server will read or submit data. |
| Top 25 Vulnerability Parameters based on frequency | For basic researches, top 25 vulnerable parameters based on frequency of use with reference to various articles. These parameters can be used for automation tools or manual recon. |
| Top 25 Vulnerability Parameters based on frequency | For basic researches, top 25 vulnerable parameters based on frequency of use with reference to various articles. These parameters can be used for automation tools or manual recon. |
| Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version… | Having blogged about exploiting SSRF on AWS EC2 instances in the past, we wanted to give you an update on where things stand now. Server Side Request Forgery can be an extremely lucrative finding to an attacker because of the ability to make requests from the target machine. |
| Block or report hackerscrolls | Contact GitHub support about this user’s behavior. Learn more about reporting abuse. |
| SSRF | |
| /home/six2dez/.pentest-book | /home/six2dez/. |
| SSRFIRE | An automated SSRF finder. Just give the domain name and your server and chill! ;) It also has options to find XSS and open redirects. If you don't have burpsuite professional, you can use interact sh by the awesome projectdiscovery team as your server. |
| Web ApplicationApril 7, 2022Server-Side Request Forgery (SSRF) | SSRF vulnerabilities allow an attacker to send crafted malicious requests from the back-end server of a vulnerable application. Criminals usually operate SSRF attacks to target internal systems that are behind firewalls and are not unrestricted from the external network. |
| Understanding and Testing for SSRF | Clint Kehr Ethical Hacker Senior Instructor |
| Server-Side Request Forgery (SSRF) Attacks: The Ultimate Guide | Several significant cybersecurity breaches in recent years, including Capital One and Microsoft Exchange, involved server-side request forgery (SSRF) as a penetration method. These exploits can give attackers access to your organization’s most sensitive data. |
| SSRF (Server Side Request Forgery) | HackTricks Search… ⌃K HackTricks Search… ⌃K 👾 Welcome! HackTricks About the author Getting Started in Hacking 🤩 Generic Methodologies & Resources Pentesting Methodology External Recon Methodology Pentesting Network Pentesting Wifi Phishing Methodology Basic Forensic Methodology Brute |
| How To: Server-Side Request Forgery (SSRF) | Server-Side Request Forgery, SSRF for short, is a vulnerability class that describes the behavior of a server making a request that’s under the attacker’s control. This post will go over the impact, how to test for it, the potential pivots, defeating mitigations, and caveats. |
| Beginner Guide To Exploit Server Side Request Forgery (SSRF) Vulnerability | Server Side Request Forgery (SSRF) is simply an attack where the server will make a request (act like a proxy) for the attacker either to a local or to a remote source and then return a response containing the data resulting from the request. |
| WSTG - v4.2 | Web applications often interact with internal or external resources. While you may expect that only the intended resource will be handling the data you send, improperly handled data may create a situation where injection attacks are possible. |
| Burp Suite For Pentester: HackBar | Isn’t it a bit time consuming and a boring task to insert a new payload manually every time for a specific vulnerability and check for its response? |
| SSRF (Server Side Request Forgery) testing resources | Status codes: 300, 301, 302, 303, 305, 307, 308 |
| MindMaps 🗺️ | This repository stores and houses various Mindmaps for bug bounty Hunters🧑🦰, pentesters🧑🦰 and offensive(🔴)/defensive(🔵) security Professionals🫂 provided by me as well as contributed by the community🧑🏻🤝🧑🏽. |
| Carrying Out Your First SSRF Attack | Hi, within this lecture we're going to do our first SSRF attack so that you can understand this in a much better way while implementing it or executing it yourself. So, let's see the example over here. So, it says that consider like an e-commerce application or e-commerce website. |
| Name already in use | Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today: |
| Server Side Request Forgery Prevention | The objective of the cheat sheet is to provide advices regarding the protection against Server Side Request Forgery (SSRF) attack. This cheat sheet will focus on the defensive point of view and will not explain how to perform this attack. |
| Server-Side Request Forgery (SSRF) | In this chapter, we are going to learn about server-side request forgery (or also called SSRF). In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. |
| SSRF Cheat Sheet & Bypass Techniques ∞ | What is SSRF? Server Side Request Forgery (SSRF) is a web vulnerability that allows an attacker to exploit vulnerable functionality to access server side or local network services / functionality by affectively traversing the external firewall using vulnerable web functionality. |
| Server Side Request Forgery (SSRF) Attacks & How to Prevent Them | Server-Side Request Forgery (SSRF) attacks allow an attacker to make requests to any domains through a vulnerable server. Attackers achieve this by making the server connect back to itself, to an internal service or resource, or to its own cloud provider. |
| URL Format Bypass | |
| SSRF and Open Redirect CheatSheet | SSRF Basic ?url=http://localhost/server-status ?url=http://127.0.0.1/server-status ?url=http://internal_domain/page ?url=http://internal_ip(192.138.0.14)/page Bypass SSRF with Special chars ?url=http://allow_domain. |
| My First Bounty From SSRF: From Finding a Vulnerability to Cashing In | Hello peoples, I’m Muhammad Julfikar Hyder from Bangladesh back again with my first bounty story today. You can also read my previous blog here How I hacked LINE’s bucket. |
| Server-Side Request Forgery(SSRF) CYBERTALENTS | Server Side Request Forgery is a web security vulnerability that allows the attacker to interact with the internal infrastructure of the target which is not accessible from outside the target network. |
| 1. The Accidental SSRF | OWASP top 10 includes SSRF in the categories, still finding SSRF can usually be tricky. These attacks occur when an application is fetching data from a user-supplied URL, without any validations. |
| Server-Side Request Forgery (SSRF) involves an attacker tricking a server into making unauthorized… | Server-Side Request Forgery (SSRF) involves an attacker tricking a server into making unauthorized requests on behalf of the attacker. This type of attack can be hazardous, as it can allow the attacker to gain access to sensitive information, such as user data or internal network details. |
| yeswehack/vulnerable-code-snippets | YesWeHack present code snippets containing several different vulnerabilities to practice your code analysis. The code snippets are beginner friendly but suitable for all levels! |
| A Glossary of Blind SSRF Chains | What is Server Side Request Forgery (SSRF)? Server Side Request Forgery occurs when you can coerce a server to make arbitrary requests on your behalf. As the requests are being made by the server, it may be possible to access internal resources due to where the server is positioned in the network. |
| Hey man if I talk about the impact it is comparatively low than that of normal ssrf because of its… | Hey man if I talk about the impact it is comparatively low than that of normal ssrf because of its one way nature. The only impact it has is you can steal the internal IPs and in rare case it can lead you to RCE. |
| Server-Side Request Forgery (SSRF)- PortSwigger Labs | This lab has a stock check feature that fetches data from an internal system. To solve the lab, use the stock check functionality to scan the internal 192.168.0.X range for an admin interface on port 8080, then use it to delete the user carlos. |
| SSRF Vulnerability From a Developer’s Perspective | OWASP Top 10 provides users a list of vulnerabilities in the field of application security. This list is prepared based on the severity of the occurrence of an attack, SSRF is one of them. |
| Let’s Understand SSRF vulnerability | In most cases, the OWASP Top 10 will publish a list of vulnerabilities. These are the broad categories that encompass the various types of vulnerabilities. |
| 👩💻Roadmap to Cybersecurity in 2022, Full-Read SSRF, IDOR in GraphQL, GCP Pentesting, and much… | Watch this talk about $25 billion+ of value, locked in the practical attacks against bridges. Welcome to the #IWWeekly28 — the Monday newsletter that brings the best in Infosec straight to your inbox. |
| 👩💻 $600k Bounty, Jetty Features, Response Queue Poisoning, Bypass SSRF Protections, XSS… | This simple business logic flaw in smart contracts resulted in a $600K bounty. Welcome to the #IWWeekly26 — the Monday newsletter that brings the best in Infosec straight to your inbox. |
| Exploiting XXE for SSRF | Server-Side Request Forgery (SSRF):- SSRF is an attack in which an attacker can force a vulnerable server to trigger malicious requests to third-party servers and or to internal resources. |
| The Tale Of SSRF To RCE on .GOV Domain | Welcome back, I hope everyone is well. Without further hesitation let’s dive into it! What is SSRF? SSRF is Server Side Request Forgery. This is a high/critical vulnerability when demonstrated with impact. |
| Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports | In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw. SSRF is when you, as an attacker, successfully make the application triggering arbitrary requests. |
| Dark Side 108: Intro to SSRF | Today’s challenge demonstrated a Server-Side Request Forgery attack. As it sounds, this attack tricks a website into letting a user into the backend server supporting a public facing web application. These vulnerabilities usually exist as a result of improper error handling… |
| A Pentester’s Guide to Server Side Request Forgery (SSRF) | This blog will be one of many created alongside our Hacking How-To series, an educational video series around everyday pentest findings. The first installment will explore Server Side Request Forgery (SSRF). |
| AWS internal metadata accessed through SSRF by Chaining an Open Redirect bug | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to get AWS metadata accessed through SSRF by chaining it with a open direct vulnerability This is the write of my Recent bug that i found . |
| SSRF payloads | The service nip.io is awesome for that, it will convert any ip address as a dns. Allows an attacker to fetch any content from the web, it can also be used to scan ports. |
| How i converted SSRF TO XSS in jira. | Before i start Acunetix does Subdomain scans so just set the time out to 20 and you will get a really big list with banners and response headers. (it does the half of the work for you.) Now, i een through lots of subdomains and i was specifically looking for any jira environment , and i found one. |
| Finding SSRF via HTML Injection inside a PDF file on AWS EC2 | During a recent application vulnerability assessment we found a Stored HTML Injection vulnerability that was quickly escalated to a full Server Side Request forgery (SSRF) on a AWS EC2. We test a lot of applications hosted in AWS, especially on EC2. |
| Escalating SSRF to Accessing all user PII information by aws metadata | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to leaked all user PII information by SSRF aws metadata exploitation. Don’t go outside without any reason . Stay home be safe and also safe other. |
| Blind SSRF - The Hide & Seek Game | Hello everyone I wanted to share one of my finding related to Blind SSRF on a private program on HackerOne for which they paid me $400. Blind SSRF vulnerabilities occur when an application is making a request to a back-end server due to some reasons but the response is not shown on the front-end. |
| Exploiting: SSRF For Admin Access | Server-Side Request Forgery (SSRF):- SSRF is an attack in which an attacker can force a vulnerable server to trigger malicious requests to third-party servers and or to internal resources. |
| Server-Side Request Forgery | Server-side request forgery, or SSRF, is a vulnerability that allows an attacker to use a vulnerable server to make HTTP requests on the attacker’s behalf. This is similar to CSRF as both the vulnerabilities perform HTTP requests without the victim acknowledging it. |
| From SSRF To RCE in PDFReacter | What is PDFReacter? - PDFReacter is a parser which parses HTML content from HTML to PDF. While testing an application I have identified that an application is using the PDFReacter parser. |
| Server Side Request Forgery (SSRF) Testing | Well this story is just for fun testing SSRF not a bounty write up. I found a random web that vulnerable to SSRF but in order to exploit it i should convert my input to base64. Here is the site . If i decode the base64 then i got this pacman game site http://www.top80sgames.com/site/content/pacman. |
| Exploiting an SSRF: Trials and Tribulations | I mostly wanted to share this post not because it’s a novel and unique attack, but to show the thought process of attacking this particular functionality, and understanding how the system works to identify what would and would not work. |
| Chaining an Blind SSRF bug to Get an RCE | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be Discussing how I was able to get RCE by using Blind SSRF. But still there is a chance that will will missing some url. |
| SSRF | Not all SSRF vulnerabilities return the response to the attacker. This type of SSRF is known as blind SSRF To demonstrate we will use test.smtp.org testing server. |
| Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text | This post is about how I and my friend got roughly 2500$ from Cafebazaar bug bounty program. During the recon phase, I enumerated the mailx.hezardastan.net host, the Cafebazaar’s webmail access. I conducted a port scanner: |
| My First Bug: Blind SSRF Through Profile Picture Upload | Hello all! This is a writeup for my first bug, an SSRF! My next writeup will most likely be about my specific approach to learning in bugbounty hunting which I hope will be massively helpful for newcomers. Feel free to follow me right here on medium, or on twitter for updates. |
| Story Behind Sweet SSRF. | Hey everyone! I hope you all are doing well! Rohit soni is back with another write-up and this time it’s about critical SSRF which leads to AWS credentials disclosure. Let’s dive into it without wasting time. |
| PHP SSRF Techniques | In this article, I want to go deep on a few SSRF techniques that you can use against a PHP script that use filters like filter_var() or preg_match() and get HTTP contents using curl or file or file_get_contents(). |
| Story of a really cool SSRF bug. | Hello all! My name is Vedant, also known as Vegeta(on twitter). I’m a cybersecurity enthusiast and a bug bounty hunter. This is my first write-up of 2021. This write-up is about a SSRF vulnerability that allowed me to access the AWS metadata of the target company. So let’s get started, |
| How Github recon help me to find NINE FULL SSRF Vulnerability with AWS metadata access | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to to find 9 full SSRF vulnerability with AWS metadata access BY doing some GITHUB recon. Don’t go outside without any reason . Stay home be safe and also safe other. |
| Finding SSRF BY Full Automation | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to Find ssrf vulnerability by bu automating it and leak private information amazon metadata, ec2 and cloud services. |
| Reading Internal Files using SSRF vulnerability | Neeraj SonaniyaOct 16, 20172 min read·I am hunting on one private program since last 8 months, since it doesn’t allow disclosure i will keep organization REDACT, in requests i will use ‘example.com’ as its name. |
| Intro to SSRF | Successful cyberattacks often start at the “network perimeter”. As a company grows, it becomes increasingly difficult to secure the hundreds and thousands of machines on the network. |
| The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise! | Hi Guys, Back with an interesting hack that I was eagerly waiting to get the writeup to publish. This hack is about a chain of vulnerabilities which includes multiple bypasses in a various different layer which finally lead to access of AWS credentials in India’s biggest stock broker company. |
| $10000 Facebook SSRF — Bug Bounty | This is a write-up about a SSRF vulnerability I found on Facebook. The vulnerability could have allowed a malicious user to send internal requests to the Facebook corporate network. |
| Vimeo upload function SSRF | As you can see, It sends the file URL with google authorization to let the backend server fetch the file from the url and pass the authorization on the header to access the file from google drive. |
| Just Gopher It: Escalating a Blind SSRF to RCE for $15k | The bug bounty program which this vulnerability was discovered on has not allowed for public disclosure, therefore I will not be directly naming the program involved. What I can say — this was discovered on the main scope of one of Hackerone’s longest-running, largest bug bounty programs. |
| Bypassing SSRF Protection | Ok. So you’ve found a feature on a web application that fetches external resources. You’re able to pull content from all sorts of external sites and there doesn’t seem to be any restrictions on the file type that you can request… The application displays everything right back at you. |
| SSRF - Server Side Request Forgery (Types and ways to exploit it) Part-1 | What is SSRF? Server Side Request Forgery (SSRF) refers to an attack where in an attacker is able to send a crafted request from a vulnerable web application. |
| How i found an SSRF in Yahoo! Guesthouse (Recon Wins) | As i said before sharing is caring, here i am describing one of my findings that was closed 2 weeks ago in yahoo Guesthouse https://gh.bouncer.login.yahoo.com/ and i am describing in details, how recon helped me finding a vulnerable endpoint where i achieved the SSRF. |
| SSRF in the Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| Vimeo SSRF with code execution potential. | Recently I discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how I found & exploited it. So let's get started. Vimeo provides an API console for their API called API Playground, The requests made using this web app is done from server-side. |
| Server-Side Request Forgery | Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf. The service nip.io is awesome for that, it will convert any ip address as a dns. |
| Multiple HTTP Redirects to Bypass SSRF Protections | I needed to utilize many known SSRF techniques at once to successfully exploit many endpoints in the same company. After discovering away, I applied it to all functionalities that use attacker-controlled URLs and found 2 blind and 1 full read SSRFs. |
| SSRF vulnerabilities and where to find them | Server-Side Request Forgery (SSRF) occurs when an application accepts a URL (or partial URL) from the user, then accesses that URL from the server. It’s important to note that SSRF is only a vulnerability if there is some security impact. |
| lorsrf | lorsrf Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST Methods NOTE Lorsrf has been added to scant3r with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github. |
| What is Server-Side Request Forgery (SSRF)? | Server-side request forgery (SSRF) vulnerabilities let an attacker send crafted requests from the back-end server of a vulnerable web application. Criminals usually use SSRF attacks to target internal systems that are behind firewalls and are not accessible from the external network. |
| An overlooked parameter leads to a critical SSRF in Dropbox bug bounty program | Check out Intigriti: https://www.intigriti.com/ 📧 Subscribe to BBRE Premium: https://bbre.dev/premium ($20 OFF with code BIRTHDAY) ✉️ Sign up for the mailing list: https://bbre.dev/nl 📣 Follow me on Twitter: https://bbre.dev/tw This video is an explanation of an SSRF found by Harsh Jaisw |
| This one trick will exploit URL parsers to perform SSRF | In this write up, I will be detailing my thought process and solution to the Hack the Box (HTB) web challenge: Weather App. I learned main pieces of how to do such an exploit from the presentation: A New Era of SSRF — Exploiting URL Parser in Trending Programming Languages! by Orange Tsai. |
| SVG SSRF Cheatsheet | Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. |
| Th0h0/autossrf | Summary autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. |
| Capital One SSRF | Kontra | |
| Awesome SSRF writeups | This is currently work in progress I will add more resources as I find them. |
| SSRFmap | SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. |
| 10 Types of Web Vulnerabilities that are Often Missed | Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community for ethical hackers passionate about securing modern technologies and end users. |
| SSRF In The Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| Story of a really cool SSRF bug. | Hello all! My name is Vedant, also known as Vegeta(on twitter). I’m a cybersecurity enthusiast and a bug bounty hunter. This is my first write-up of 2021. This write-up is about a SSRF vulnerability that allowed me to access the AWS metadata of the target company. So let’s get started, |
| $10000 Facebook SSRF — Bug Bounty | This is a write-up about a SSRF vulnerability I found on Facebook. The vulnerability could have allowed a malicious user to send internal requests to the Facebook corporate network. |
| Top 25 Vulnerability Parameters based on frequency | For basic researches, top 25 vulnerable parameters based on frequency of use with reference to various articles. These parameters can be used for automation tools or manual recon. |
| 🔥 ssrf-king 🔥 | 🔥 ssrf-king 🔥 v1. |
| How i found 3 SSRF in one day on different bug bounty targets. | My name is damanpreet singh. This is my first write-up, so please forgive me for my mistakes. So, lets start: I started bug bounties after about a year. I was only learning, still i am learning. So, some days ago i thought , now i should start to looking for bugs. |
| Server Side Request Forgery | Server side request forgery is one of the web vulnerabilities which allows an attacker to use the backend server to make unintended requests to the internal systems. |
| Finding SSRF via HTML Injection inside a PDF file on AWS EC2 | During a recent application vulnerability assessment we found a Stored HTML Injection vulnerability that was quickly escalated to a full Server Side Request forgery (SSRF) on a AWS EC2. We test a lot of applications hosted in AWS, especially on EC2. |
| The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise! | Hi Guys,Back with an interesting hack that I was eagerly waiting to get the writeup to publish. This hack is about a chain of vulnerabilities which includes multiple bypasses in a various different layer which finally lead to access of AWS credentials in India’s biggest stock broker company. |
| Vimeo SSRF with code execution potential. | Recently i discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how i found & exploited it. So lets get started. Vimeo provides an API console for their API called API Playground, The requests made using this web app is done from server side. |
| [bugbounty] A Simple SSRF | |
| Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version… | Having blogged about exploiting SSRF on AWS EC2 instances in the past, we wanted to give you an update on where things stand now. Server Side Request Forgery can be an extremely lucrative finding to an attacker because of the ability to make requests from the target machine. |
| Intro to SSRF | Successful cyberattacks often start at the “network perimeter”. As a company grows, it becomes increasingly difficult to secure the hundreds and thousands of machines on the network. |
| Server-Side Request Forgery (SSRF) vulnerable Lab | This repository contain PHP codes which are vulnerable to Server-Side Request Forgery (SSRF) attack. In programming languages, there are functions which can fetch the contents of locally saved file. These functions may be capable of fetching the content from remote URLs as well local files (e. |
| B-XSSRF - Toolkit To Detect And Keep Track On Blind XSS, XXE And SSRF | Toolkit to detect and keep track on Blind XSS, XXE & SSRF. |
| SSRF bible. Cheatsheet - Google Docs | |
| SSRF in the Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| Bypassing SSRF Protection | Ok. So you’ve found a feature on a web application that fetches external resources. You’re able to pull content from all sorts of external sites and there doesn’t seem to be any restrictions on the file type that you can request… The application displays everything right back at you. |
| B-XSSRF | B-XSSRF Toolkit to detect and keep track on Blind XSS, XXE & SSRF SETUP Upload the files to your server. Create a Database and upload database.sql file to it. Change the DB Credentials in db.php file. Ready. USAGE BLIND XSS <embed src="http://mysite.com/bxssrf/request. |
| SSRF in the Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| Bypassing SSRF Protection | Ok. So you’ve found a feature on a web application that fetches external resources. You’re able to pull content from all sorts of external sites and there doesn’t seem to be any restrictions on the file type that you can request… The application displays everything right back at you. |
| SSRF Vulnerability due to Sentry misconfiguration | That story happened when I saw that disclosed report. And funny thing is that I remembered that saw some Sentry requests in my BuprSuit Proxy in my current project. From that point of view, I highly recommend to not filtering Proxy history. |
| SVG XLink SSRF fingerprinting libraries version | Since parser is blocking SYSTEM based entities our attack surface has been limited, Now it’s time to test Billion Laughs attack since application allowed static entities. |
| The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise! | Hi Guys,Back with an interesting hack that I was eagerly waiting to get the writeup to publish. This hack is about a chain of vulnerabilities which includes multiple bypasses in a various different layer which finally lead to access of AWS credentials in India’s biggest stock broker company. |
| From SSRF To RCE in PDFReacter | What is PDFReacter? - PDFReacter is a parser which parses HTML content from HTML to PDF. While testing an application I have identified that an application is using the PDFReacter parser. |
| AWS takeover through SSRF in JavaScript | Here is the story of a bug I found in a private bug bounty program on Hackerone. It took me exactly 12h30 -no break- to find it, exploit and report. |
| Into the Borg – SSRF inside Google production network | In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I realised that Google Sites was using an unpatched version of Google Caja, so I looked if it was vulnerable to the XSS. |
| Server Side Request Forgery (SSRF) Testing | Well this story is just for fun testing SSRF not a bounty write up. I found a random web that vulnerable to SSRF but in order to exploit it i should convert my input to base64. Here is the site http://playfreedownloadgames.com:2483/proxy. |
| How i converted SSRF TO XSS in jira. | Before i start Acunetix does Subdomain scans so just set the time out to 20 and you will get a really big list with banners and response headers. (it does the half of the work for you.) Now, i een through lots of subdomains and i was specifically looking for any jira environment , and i found one. |
| How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! | Hi, it’s been a long time since my last blog post. In the past few months, I spent lots of time preparing for the talk of Black Hat USA 2017 and DEF CON 25. Being a Black Hat and DEFCON speaker is part of my life goal ever. This is also my first English talk in such formal conferences. |
