The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-11-04 2025 | #ssrf #xss #sqli #python beginner | The content appears to be related to cybersecurity topics including Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), SQL Injection (SQLi), and Python programming. The link provided seems to lead to additional information or resources on these subjects. |
| 2025-11-04 2025 | Hey my ebooks are also on the #BlackNovember promo check it out! #BugBounty #SSRF #XSS #Bypass beginner | The content promotes ebooks on a #BlackNovember promo, highlighting topics like #BugBounty, #SSRF, #XSS, and #Bypass. The author encourages checking out the promotion for their ebooks. |
| 2025-11-04 2025 | DAY 3-5/30 Deep-dive on SSRF research to strengthen real-world exploitation skills Completed 2/18 SQLi labs on @PortSwigger #BugBounty #SSRF #SQLi #WebSecurity #Infosec intermediate | The content highlights progress made on days 3-5 of a 30-day deep dive into SSRF research to enhance real-world exploitation skills. It mentions completing SQL injection labs on @PortSwigger on February 18. The focus is on bug bounty, SSRF, SQLi, web security, and infosec. The post indicates active engagement in cybersecurity research and skill development in the context of bug bounty programs. |
| 2025-11-03 2025 | Completed my first basic SSRF lab on #PortSwigger today. Used an #SSRF to make the server request http://localhost which let me reach the internal /admin #endpoint and delete a user without admin #credentials. #hacking #security beginner | The content describes completing a basic SSRF lab on PortSwigger, utilizing SSRF to send a server request to http://localhost, accessing the internal /admin endpoint, and deleting a user without admin credentials. The post highlights the hacking and security aspects of this exercise. |
| 2025-11-03 2025 | Completed my first basic SSRF lab on #PortSwigger today. Used an #SSRF to make the server request http://localhost which let me reach the internal /admin #endpoint and delete a user without admin #credentials. #hacking #security beginner | The content discusses completing a basic SSRF lab on PortSwigger by using SSRF to send a server request to http://localhost, accessing the internal /admin endpoint, and deleting a user without admin credentials. This demonstrates a security vulnerability that could be exploited for unauthorized actions. The post highlights the importance of understanding and securing against SSRF attacks in the context of hacking and security. |
| 2025-11-01 2025 | CVE-2025-10145 Auto Featured Image 4.1.7 vulnerable to SSRF allowing internal data access on cloud servers. Update now & scan with Quttera Website Malware Scanner quttera.com #CVE #WordPressSecurity #SSRF #CyberSecurity #WordPress news | The content warns about CVE-2025-10145 vulnerability in Auto Featured Image ≤4.1.7, enabling SSRF for accessing internal data on cloud servers. It advises updating the plugin and scanning with Quttera Website Malware Scanner. The post emphasizes the importance of cybersecurity, specifically for WordPress sites. |
| 2025-11-01 2025 | WP 6.8.3 ZERO-DAY SSRF: LEAKS ORIGIN IP behind Cloudflare! Unauth exploit hits MILLIONS of sites. PoC: github.com/ebrasha/ssrf-p Demo: github.com/ebrasha/ssrf-p @ProfShafiei @WordPress @automattic @Cloudflare @TheHackersNews #SSRF #ZeroDay #WordPress #Vulnerability news | A zero-day SSRF vulnerability in WordPress 6.8.3 allows leaking the origin IP behind Cloudflare, affecting millions of sites. An unauthorized exploit is circulating, with Proof of Concept and Demo available on GitHub. The vulnerability poses a significant risk, prompting attention from security experts and organizations like WordPress, Automattic, Cloudflare, and TheHackersNews. The exploit highlights the seriousness of SSRF attacks and the importance of prompt patching to mitigate potential risks. |
| 2025-10-31 2025 | Great collaboration and knowledge sharing around bug bounty teamwork makes us stronger! @Wlayzz @truffzor @LdrTom #rce #ssrf #xss #BugBounty @yeswehack news | The content highlights the importance of collaboration and knowledge sharing in bug bounty teamwork to enhance strength. It mentions specific individuals and tags related to bug bounty topics like Remote Code Execution (RCE), Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), and BugBounty. The post also includes a reference to YesWeHack. |
| 2025-10-30 2025 | DAY 1/30 - SSRF learning path completed on @PortSwigger Web Security Academy. #SSRF #WebSecurity beginner | The user completed the SSRF learning path on PortSwigger Web Security Academy on the first day of a 30-day challenge. The achievement was shared on social media with hashtags #SSRF and #WebSecurity. |
| 2025-10-29 2025 | Heres a 0-day SSRF in SimplePie to turn it into a port scanner. I found it a while ago. #0day #SSRF advanced | The content discusses a zero-day Server-Side Request Forgery (SSRF) vulnerability in SimplePie that can be exploited to turn it into a port scanner. The author discovered this vulnerability some time ago and shared it with the hashtag #0day #SSRF. The post provides a link for more information. |
| 2025-10-29 2025 | New Critical CVE I discovered: CVE-2025-60898 Unauthenticated SSRF CVSS 9.1 Advisory: github.com/abdulr7mann/CV CVE record: cve.org/CVERecord?id=C #CVE #SSRF #AppSec #AppSecurity news | A new Critical CVE, CVE-2025-60898, an Unauthenticated SSRF with a CVSS score of 9.1, has been discovered. More details can be found in the advisory at github.com/abdulr7mann/CV. The CVE record is available at cve.org/CVERecord?id=C. This vulnerability is significant for application security (#AppSec) and involves Server-Side Request Forgery (#SSRF). |
| 2025-10-29 2025 | Dear Bounty Hunters what tools/workflows do you use to find SSRF? Name the tool categories (proxy scanner recon logging) and one tip for responsible disclosure. No exploit recipes just the stack and process that works for you. #BugBounty #SSRF #InfoSec #EthicalHacking intermediate | The content discusses tools and workflows used by bounty hunters to find Server-Side Request Forgery (SSRF) vulnerabilities. It mentions tool categories like proxy, scanner, recon, and logging, and emphasizes responsible disclosure. The focus is on sharing the stack and process that works for identifying SSRF vulnerabilities, without providing exploit recipes. The post encourages ethical hacking practices and participation in bug bounty programs. |
| 2025-10-28 2025 | Start your journey into #SSRF. brutelogic.net/ssrf-mastery-s beginner | The content invites readers to begin exploring Server-Side Request Forgery (SSRF) through a resource provided on brutelogic.net. The link leads to a page where individuals can enhance their understanding and skills related to SSRF. It encourages users to embark on a learning journey focused on this topic. |
| 2025-10-27 2025 | 10/ TL;DR do more with less: timing DNS rotation header correlation = high-signal low-noise POCs. Share if you want the helper repo SVG cheat-sheet. #SSRF #infosec #bugbounty intermediate | The content discusses maximizing efficiency by combining timing, DNS rotation, and header correlation for effective proof-of-concepts (POCs) with high signal and low noise. It suggests sharing for a helper repository and SVG cheat-sheet. The focus is on improving security testing, particularly related to SSRF (Server-Side Request Forgery) and bug bounty programs. |
| 2025-10-23 2025 | Thanks for featuring our post Next.js and the Mutated Middleware #AppSec #Nextjs #SSRF news | The content is a thank-you message for featuring a post titled "Next.js and the Mutated Middleware" that discusses application security, Next.js framework, and SSRF vulnerability. The post was shared with hashtags #AppSec, #Nextjs, and #SSRF. |
| 2025-10-23 2025 | Finished Intro to SSRF on @TryHackMe hands-on SSRF directory traversal. Flag captured; tested mitigations. #InfoSec #SSRF #tryhackme beginner | The content discusses completing an introductory task on Server-Side Request Forgery (SSRF) on TryHackMe platform, involving practical exercises on SSRF and directory traversal. The user successfully captured a flag and tested mitigations for SSRF. The post includes hashtags related to information security, SSRF, and TryHackMe. |
| 2025-10-22 2025 | CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw | The Cyber Security Hub news | CISA has confirmed that hackers exploited a SSRF flaw in Oracle E-Business Suite. This vulnerability allowed attackers to carry out attacks by sending unauthorized requests from the vulnerable server. The Cyber Security Hub reported on this incident. |
| 2025-10-21 2025 | CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw news 2 min read | Writeup of CVE-2025-61884, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Oracle E-Business Suite, now confirmed by CISA as actively exploited. This flaw in the Oracle Configurator runtime component was leveraged in July attacks, with exploits leaked by ShinyHunters and potentially used by the Clop ransomware gang. Oracle has released patches and recommended federal agencies apply them by November 10, 2025, to mitigate unauthorized data access risks. → bleepingcomputer.com |
| 2025-10-20 2025 | $6000 bounty for a juicy SSRF that exposed internal files K8s access tokens & Lambda runtime API Massive props to @saur1n killer teamwork on this one! Customer paid directly no Bugcrowd triage needed. #Bugcrowd #SSRF intermediate | A $6000 bounty was rewarded for discovering a significant SSRF vulnerability that exposed internal files, Kubernetes access tokens, and Lambda runtime API. The successful finding was attributed to teamwork and praised @saur1n. The customer paid the bounty directly without involving Bugcrowd for triage. The incident highlights the importance of identifying and addressing SSRF vulnerabilities in web applications. |
| 2025-10-17 2025 | Found a "fixed" WordPress SSRF that wasn't actually fixed. Null byte truncation bypassed all validation exposing AWS metadata/credentials through a patched plugin. Full technical breakdown PoC: CVE-2025-10874 intermediate | A WordPress SSRF vulnerability believed to be fixed was actually still exploitable due to null byte truncation bypassing validation. This flaw exposed AWS metadata/credentials through a patched plugin. The technical details and proof of concept for this issue can be found under CVE-2025-10874. |
| 2025-10-14 2025 | Oracle has silently fixed CVE-2025-61884 a critical E-Business Suite SSRF vulnerability exploited by Clop and ShinyHunters for remote unauthenticated access to sensitive data. #OracleEBS #ZeroDay #SSRF news | Oracle has addressed a critical SSRF vulnerability (CVE-2025-61884) in E-Business Suite that was exploited by threat actors like Clop and ShinyHunters. This flaw allowed remote, unauthenticated access to sensitive data. The fix was implemented silently by Oracle to prevent further exploitation. #OracleEBS #ZeroDay #SSRF. |
| 2025-10-14 2025 | Finished Intigriti Challenge 1025 SSRF LFI Exploited a weak stripos('http') check to trigger a local file read via file://...#http. Full writeup PoC #bugbounty #ssrf #lfi #websecurity #intigriti intermediate | The content discusses successfully completing Intigriti Challenge 1025 by exploiting a weak stripos('http') check to trigger a local file read via file://...#http. The post includes a full writeup and proof of concept (PoC) related to SSRF and LFI vulnerabilities in web security. It also mentions hashtags like #bugbounty, #ssrf, #lfi, and #websecurity. |
| 2025-10-10 2025 | Have been here on X providing lots of things I found about #XSS filter/WAF evasion #SQLi even #SSRF and other stuff as @BRuteLogic for the last 13 yrs. So please don't think I'm just advertising w/ the content I create I'm just trying to make a living out of my work. Thx. beginner | For over 13 years, the individual has been sharing insights on XSS, filter/WAF evasion, SQLi, SSRF, and related topics as @BRuteLogic. They clarify that their content creation is not just advertising but a means to sustain themselves. The post emphasizes the longevity and dedication to providing valuable information in the cybersecurity field. |
| 2025-10-09 2025 | "SSRF - When the Server Becomes Your Hacker" Follow FORnSEC Solutions for more interesting Cyber related topics. @www.fornsec.in Youtube Channel :- #cybersecurity #SSRF #AppSec #InfoSec #Serversiderequestforgery #explorepage #explore #exploit #trending beginner | The content discusses SSRF (Server-Side Request Forgery) and its implications, highlighting how servers can be manipulated to act as hackers. It encourages following FORnSEC Solutions for more cyber-related topics and provides links to their website and YouTube channel. The hashtags indicate the content covers cybersecurity, SSRF, application security, information security, server-side request forgery, exploring trends, and exploits. The post aims to attract interest in these topics and promote further exploration of cybersecurity issues. |
| 2025-10-08 2025 | Tips to ur tests n hunts: Site generates a custom PDF using user input test for #HTML #injection. Try #SSRF via an iframe to read metadata files: Use ur imagination - verify other possibilities #cybersecurity intermediate | The content provides tips for testing and hunting for cybersecurity vulnerabilities. It suggests generating a custom PDF using user input to test for HTML injection. Additionally, it recommends trying Server-Side Request Forgery (SSRF) via an iframe to read metadata files. The advice emphasizes using imagination to explore various possibilities for cybersecurity testing. |
| 2025-10-06 2025 | Splunk issued patches for six flaws including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform. #Splunk #SplunkSecurity #SSRF #XSS #Cybersecurity news | Splunk recently released patches for six vulnerabilities, including a critical blind SSRF (CVE-2025-20371) and XSS flaws. These issues could be exploited by attackers to gain unauthorized access to sensitive data and potentially crash the Splunk platform. The patches aim to address these security vulnerabilities and enhance the overall cybersecurity of the Splunk system. #Splunk #SplunkSecurity #SSRF #XSS #Cybersecurity |
| 2025-10-06 2025 | Payload-less exploits cause real damage without dropping malware SSRF XXE IDOR. Most scanners miss them. Recon chains catch them. Read more #CyberSecurity #AppSec #SSRF #XXE #IDOR #Recon #ThreatIntel #Infosec intermediate | The content discusses how payload-less exploits like SSRF, XXE, and IDOR can cause significant damage without dropping malware. These exploits are often missed by scanners but can be detected by recon chains. The post emphasizes the importance of understanding and addressing these vulnerabilities in cybersecurity to prevent potential threats. It encourages readers to learn more about these issues and provides relevant hashtags for further exploration. |
| 2025-10-05 2025 | SSRF attacker tricks your server into fetching URLs it shouldn't (internal admin or metadata). Stop it: dont fetch user URLs directly use allowlists block private/internal IPs enforce egress filters/proxy and require auth for internal services #WebSecurity #SSRF #InfoSec intermediate | The content warns about SSRF attacks where servers fetch unauthorized URLs. To prevent this, avoid fetching user URLs directly, use allowlists, block private/internal IPs, enforce egress filters/proxy, and require authentication for internal services. These measures enhance web security and protect against SSRF threats. #WebSecurity #SSRF #InfoSec |
| 2025-10-03 2025 | Server-Side Request Forgery (SSRF) is a rising web attack vector. An attacker can trick your app into making requests to internal or cloud resources. Learn what it is and how to prevent #AppSec #SSRF #CloudSecurity #CyberSecurity beginner | Server-Side Request Forgery (SSRF) is a growing web attack where attackers manipulate your app to access internal or cloud resources. Understanding SSRF is crucial for #AppSec, #CloudSecurity, and #CyberSecurity. Prevention measures are essential to safeguard against this threat. |
| 2025-10-02 2025 | Hack this one! KNOXSS v4.3.0 released with support to #SSRF-based #XSS regular and Blind. news | KNOXSS v4.3.0 has been released with support for SSRF-based XSS, including regular and Blind XSS. This update allows for hacking opportunities using these vulnerabilities. The release aims to enhance security testing capabilities by addressing these specific types of cross-site scripting vulnerabilities. |
| 2025-10-02 2025 | HIGH severity SSRF in Apache Kylin (v4.0.05.0.2) lets attackers abuse admin rights for internal requests. Upgrade to 5.0.3 ASAP! Details: radar.offseq.com/threat/cve-202 #OffSeq #ApacheKylin #SSRF #Cybersecurity news | A high severity Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin (v4.0.0–5.0.2) allows attackers to exploit admin rights for internal requests. Urgent upgrade to version 5.0.3 is recommended to mitigate the risk. More information available at radar.offseq.com/threat/cve-202. Take action promptly to address this cybersecurity threat. #OffSeq #ApacheKylin #SSRF #Cybersecurity |
| 2025-09-30 2025 | KNOXSS v4.3.0 is out! Now with another Blind #XSS payload in a file format to catch Rendered Blind #SSRF-based scenarios Also a regular SSRF-based Reflected Remote XHTML Inclusion. Complete detection list below. knoxss.pro/?page_id=766 #BugBounty #WebAppSec #PenTesting intermediate | KNOXSS v4.3.0 release includes a new Blind XSS payload in a file format for Rendered Blind SSRF-based scenarios and SSRF-based Reflected Remote XHTML Inclusion. The update enhances detection capabilities. More details can be found at knoxss.pro/?page_id=766. The release is relevant for Bug Bounty programs, Web Application Security, and Penetration Testing. |
| 2025-09-29 2025 | Before the next update with #SSRF-based #XSS you can already use our completely free Blind XSS Service with SVG image generator. With that customized image with your unique ID in our system you can host online or upload manually to test Blind SSRF-based scenarios. #BugBounty intermediate | The content introduces a free Blind XSS Service with an SVG image generator to test Blind SSRF-based scenarios before the next update with SSRF-based XSS. Users can create a customized image with a unique ID in the system, which can be hosted online or uploaded manually for testing purposes. The service is offered for Bug Bounty hunters. |
| 2025-09-27 2025 | This version of the polyglot payload below can help in a bypass. The addition of the localhost gives room for most of the traditional host-based SSRF tricks. file://127.0.0.1/etc/passwd?/../passwd #SSRF #LFR #Bypass #BugBounty intermediate | The content discusses a polyglot payload that includes localhost to aid in bypassing security measures. By utilizing file://127.0.0.1/etc/passwd?/../passwd, traditional host-based SSRF tricks can be employed. The post also includes hashtags related to server-side request forgery (SSRF), local file read (LFR), bypass techniques, and bug bounty programs. |
| 2025-09-27 2025 | SSRF Mastery Series - Fundamentals: Master Server-Side Request Forgery advanced 3 min read Bug Bounty | Guide to Server-Side Request Forgery (SSRF) exploitation, this resource details systematic discovery and advanced techniques from industry experts like Orange Tsai, Justin Gardner, and Corben Leo. It covers parser bypasses, TOCTOU DNS attacks, IDNA bypasses, protocol smuggling, and cloud metadata endpoint exploitation, referencing vulnerabilities such as CVE-2025-1974 (IngressNightmare) and methods for achieving five-figure bug bounty rewards. |
| 2025-09-26 2025 | Released check it out! brutelogic.net/ssrf-mastery-s #SSRF #BugBounty #PenTesting beginner | A new release is available on brutelogic.net focusing on SSRF mastery for Bug Bounty and Pen Testing. The content can be accessed at brutelogic.net/ssrf-mastery-s. The release is relevant for those interested in SSRF, Bug Bounty programs, and Pen Testing. |
| 2025-09-26 2025 | SSRF Mastery Series: Fundamentals The Complete Guide to Server-Side Request Forgery Discovery and Exploitation By @RodoAssis @BRuteLogic Check it out! #SSRF #BugBounty #PenTesting #WebAppSec brutelogic.net/ssrf-mastery-s beginner | The content is about an SSRF Mastery Series that provides a comprehensive guide on Server-Side Request Forgery (SSRF) discovery and exploitation by @RodoAssis and @BRuteLogic. The series covers fundamentals and is aimed at Bug Bounty hunters, Penetration Testers, and Web Application Security enthusiasts. The link provided directs to brutelogic.net for more information. #SSRF #BugBounty #PenTesting #WebAppSec. |
| 2025-09-26 2025 | Talking about #SSRF I just got an idea to add SSRF-based #XSS to @KN0X55 ! It's coming in the update next week most probably. #WebAppSec #BugBounty #PenTesting intermediate | The content discusses adding SSRF-based XSS to a platform called @KN0X55 in an upcoming update next week. This idea was inspired by discussions around Server-Side Request Forgery (SSRF). The update aims to enhance security measures, particularly in the realms of web application security, bug bounty programs, and penetration testing. The post also includes relevant hashtags such as #WebAppSec, #BugBounty, and #PenTesting. |
| 2025-09-26 2025 | IMDS Abused: Hunting Rare Behaviors to Uncover Exploits intermediate 10 min read | Library for detecting and mitigating abuse of cloud Instance Metadata Services (IMDS). It details how threat actors exploit IMDS for credential theft and lateral movement, focusing on techniques like Server-Side Request Forgery (SSRF) against IMDSv1 and misconfigured workloads. The library highlights a data-driven approach to anomaly hunting, identifying rare IMDS access patterns, filtering by sensitive metadata paths, and contextualizing compute environments. This methodology led to the discovery of CVE-2025-51591, a zero-day SSRF vulnerability in pandoc, exploited to access sensitive IAM credentials. → wiz.io |
| 2025-09-25 2025 | Web Pentest Tip SSRF 1 What SSRF is 2 Why its dangerous 3 Lab-only vulnerable pattern 4 Mitigation & defenses Always test with authorization. #SSRF #WebSecurity #AppSec #Infosec #OWASP #Pentesting #CloudSecurity beginner | The content provides a web pentest tip on Server-Side Request Forgery (SSRF), covering what SSRF is, why it's dangerous, lab-only vulnerable patterns, and mitigation strategies. It emphasizes the importance of testing with authorization to enhance security. The post includes relevant hashtags such as #SSRF, #WebSecurity, #AppSec, #Infosec, #OWASP, #Pentesting, and #CloudSecurity. |
| 2025-09-25 2025 | Coming ASAP! #SSRF #BugBounty beginner | The content indicates that something related to SSRF (Server-Side Request Forgery) and Bug Bounty is forthcoming soon. The hashtag #SSRF suggests a focus on SSRF vulnerabilities, while #BugBounty implies a potential reward for identifying and reporting bugs. The link provided likely leads to more details or updates on this upcoming development. |
| 2025-09-25 2025 | Side-by-Side Comparison of SSRF vs. CSRF | Attaxion beginner 9 min read CSRF | Reference comparing SSRF and CSRF attacks, detailing how Server-Side Request Forgery (SSRF), a CWE-918 vulnerability listed in OWASP Top 10 2021, targets the backend server to make unauthorized requests to internal or external resources, as seen in the Capital One breach and Microsoft Exchange attacks. Cross-Site Request Forgery (CSRF) targets the user's browser, tricking authenticated users into submitting unwanted requests by exploiting session cookies. |
| 2025-09-24 2025 | Proud to share I discovered MULTIPLE SSRF bypasses in the NPM ip lib (v2.0.1 10M weekly downloads): Null Route Bypass ("0") - CVE-2025-59437 Octal Format Bypass ("017700000001") - CVE-2025-59436 Impact: complete bypass of SSRF protections. #AppSec #SSRF #supplychainsecurity intermediate | Multiple SSRF bypasses were discovered in the NPM ip lib (v2.0.1, 10M weekly downloads): Null Route Bypass ("0") - CVE-2025-59437 and Octal Format Bypass ("017700000001") - CVE-2025-59436. These bypasses allow for a complete bypass of SSRF protections, impacting supply chain security. #AppSec #SSRF #supplychainsecurity. |
| 2025-09-24 2025 | Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials news 3 min read | Writeup of CVE-2025-51591, a Server-Side Request Forgery (SSRF) vulnerability in Pandoc, exploited in attacks targeting Amazon Web Services (AWS) Instance Metadata Service (IMDS) to steal EC2 IAM credentials. The flaw, triggered by specially crafted HTML iframe elements, allows attackers to trick applications running on EC2 instances into requesting sensitive metadata. While IMDSv2 enforcement mitigates this specific attack, the incident highlights the ongoing threat of SSRF against cloud infrastructure, similar to past abuses of Adminer. Mitigation involves using Pandoc's sandbox flags or ensuring IMDSv2 is enforced. → thehackernews.com |
| 2025-09-23 2025 | SRF vs CSRF arent the same One targets the server The other the user See the side by side comparison & protection tips: #Cybersecurity #SSRF #CSRF #Attaxion beginner | The content highlights the differences between Server-Side Request Forgery (SSRF) and Cross-Site Request Forgery (CSRF). SSRF targets the server, while CSRF targets the user. The post suggests viewing a side-by-side comparison and offers protection tips for both vulnerabilities. It emphasizes the importance of cybersecurity and includes hashtags for SSRF, CSRF, and Attaxion. |
| 2025-09-23 2025 | Server leaking secrets? Thats SSRF! Conquered Intro to SSRF on @TryHackMe. Tips: 1) Tweak URL params (e.g. 127.0.0.1) for recon. 2) Use Burp Collaborator for blind SSRF. 3) Whitelist URLs. Whos next? #CyberSec #SSRF #TryHackMe intermediate | The content discusses Server-Side Request Forgery (SSRF) vulnerabilities and provides tips for exploiting them, such as manipulating URL parameters for reconnaissance, utilizing Burp Collaborator for blind SSRF attacks, and whitelisting URLs for protection. The author shares their success in mastering an "Intro to SSRF" challenge on TryHackMe and encourages others to try it. The post is tagged with #CyberSec, #SSRF, and #TryHackMe. |
| 2025-09-23 2025 | Warning: New #Flowise vulnerabilities were published. CVE-2025-59527 (CVSS 7.5) is a #SSRF vulnerability. CVE-2025-59528 (CVSS 10.0) could result in #RCE. Keep an eye on future security bulletins and #Patch #Patch #Patch news | New vulnerabilities in #Flowise have been disclosed: CVE-2025-59527 is a #SSRF vulnerability with a CVSS score of 7.5, while CVE-2025-59528 poses a more severe risk with a CVSS score of 10.0, potentially leading to #RCE. It is crucial to stay updated on security bulletins and promptly apply patches to mitigate these vulnerabilities. #Patch #Patch #Patch. |
| 2025-09-22 2025 | Servers making secret calls? SSRF attacks can expose internal systems! Prevent it: Validate & sanitize all user-input URLs. Test your endpoints with #DentiScan. #SSRF #CyberSecurity #WebSecurity beginner | SSRF attacks can expose internal systems by tricking servers into making secret calls. To prevent this, validate and sanitize all user-input URLs. Test your endpoints using #DentiScan for improved cybersecurity and web security. #SSRF #CyberSecurity #WebSecurity. |
| 2025-09-22 2025 | MEDIUM severity alert: MuYuCMS 2.02.7 vulnerable to SSRF via Add Friend Link! Remote attackers can probe internal resources. Audit & restrict input now. Details: #OffSeq #MuYuCMS #SSRF news | MuYuCMS version 2.0-2.7 is susceptible to SSRF through the Add Friend Link, allowing remote attackers to access internal resources. It is advised to audit and limit input to prevent exploitation. This vulnerability poses a medium severity risk and should be addressed promptly. #OffSeq #MuYuCMS #SSRF |
| 2025-09-21 2025 | Flask 3.1.1 SSRF Zero-Day Shodan dork exposed 500 targets 0day PoC (CWE-918) Full Article: nullsecurityx.codes/ssrf-vulnerabi Video: youtube.com/watch?v=Levx_p Responsible disclosure & defensive demo only. #infosec #vulnerability #SSRF #BugBounty news | A zero-day vulnerability in Flask 3.1.1 related to SSRF was exposed through a Shodan dork, revealing 500+ potential targets. A proof of concept (PoC) for this vulnerability (CWE-918) was shared. The full article and a video demonstrating the issue were provided. The disclosure was done responsibly, and a defensive demo was included. The content emphasizes information security, vulnerability, SSRF, and Bug Bounty programs. The details can be found at nullsecurityx.codes/ssrf-vulnerabi and the video is available on YouTube. |