The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-07-04 2025 | Just dropped a new write-up in my Power Platform research series. This time? OneNote token leakage. Yep its still exploitable. Nope its not getting fixed. Read it on Zenity Labs: Enjoy the read #SSRF #PowerPlatform #OneNote #MSRC #ZenityLabs advanced | A new write-up in the Power Platform research series discusses OneNote token leakage, highlighting that the issue is still exploitable and won't be fixed. The content can be found on Zenity Labs. The post mentions hashtags like #SSRF, #PowerPlatform, #OneNote, #MSRC, and #ZenityLabs. |
| 2025-07-03 2025 | Excited to start my WebHacking journey with @HackingHub_io! Ready to learn grow and hack some web apps! #BugBounty #EthicalHacking #NahamSec #WebSecurity #HackingHub #Infosec #CyberSecurity #BugBountyTips #XSS #SSRF #CTF #Pentesting #HackThePlanet beginner | The content expresses excitement about starting a web hacking journey with @HackingHub_io to learn, grow, and hack web apps. It mentions hashtags related to bug bounty, ethical hacking, web security, infosec, cybersecurity, bug bounty tips, XSS, SSRF, CTF, pentesting, and hacking the planet. The individual is eager to engage in activities related to cybersecurity and hacking, showcasing enthusiasm for exploring these fields. |
| 2025-07-03 2025 | New Writeup Alert! "One SSRF to Rule Them All" by Ott3rly is now live on IW! Check it out here: #cybersecurity #informationsecurity #bugbounty #bugbountywriteup #ssrf beginner | A new writeup titled "One SSRF to Rule Them All" by Ott3rly is now available on IW. The content focuses on cybersecurity, information security, bug bounty programs, and SSRF vulnerabilities. Readers are encouraged to check out the writeup for insights and information on this topic. #cybersecurity #informationsecurity #bugbounty #bugbountywriteup #ssrf. |
| 2025-07-02 2025 | New video alert! We walk you through an SSRF vulnerability exploited step-by-step to achieve RCE. Practical detailed and perfect for pentesters & bug bounty hunters! Video: #Cybersecurity #SSRF #RCE #BugBounty intermediate | A new video demonstrates exploiting an SSRF vulnerability to achieve Remote Code Execution (RCE) in a step-by-step guide, ideal for pentesters and bug bounty hunters. The video provides practical and detailed insights into the process. It focuses on cybersecurity, SSRF, RCE, and bug bounty topics. |
| 2025-07-02 2025 | Ever wondered how attackers exploit SSRF to access internal systems? Our latest article breaks it all downtools techniques and mitigation strategies. Read now: #SSRF #CyberSecurity #RedTeamOps #Infosec #CyberWarFareLabs #Article #SecurityResearch intermediate | The content discusses how attackers exploit Server-Side Request Forgery (SSRF) to access internal systems, detailing tools, techniques, and mitigation strategies. The article provides insights into SSRF vulnerabilities and ways to protect against them. It is relevant for those interested in cybersecurity, Red Team Operations, and security research. The link provided directs readers to the full article for further information. |
| 2025-06-28 2025 | Server-Side Bugs That Pay Big SSRF (internal request abuse) SSTI (template injection) XXE (XML Entity Injection) Log4Shell-style payloads Blind bugs with Burp Collaborator Quiet bugs massive impact. #BugBounty #SSRF #EthicalHacking #bugbountytip beginner | The content discusses lucrative server-side bugs like SSRF, SSTI, XXE, Log4Shell-style payloads, and blind bugs with Burp Collaborator. These vulnerabilities can have a significant impact and are valuable for bug bounty programs and ethical hacking. Emphasizing the importance of identifying and addressing these issues, the post highlights their potential for exploitation and the need for vigilance in cybersecurity. |
| 2025-06-28 2025 | Live SSRF Demo at Cubeesec Weekly Class! Internal IPs? Metadata? IAM tokens? All exposed in seconds. We dont teach theorywe attack it. Wanna Join Us: 91 8790407216 cubeesec.group@gmail.com cubeesec.com (Coming Soon) #SSRF #cybersecurity #cubeesec intermediate | Cubeesec is offering a live SSRF demo showcasing the exposure of internal IPs, metadata, and IAM tokens within seconds. They focus on practical attacks rather than theory in their classes. Contact details for joining include a phone number, email, and website. The demonstration aims to highlight cybersecurity vulnerabilities and techniques. |
| 2025-06-27 2025 | Understanding Server Side Request Forgery (SSRF) is crucial for web security! By validating inputs whitelisting domains and monitoring requests we can mitigate risks and protect sensitive data. Let's stay vigilant! #CyberSecurity #SSRF @VisakhVijayan beginner | Understanding Server Side Request Forgery (SSRF) is vital for web security. Mitigate risks by validating inputs, whitelisting domains, and monitoring requests to protect sensitive data. Stay vigilant to enhance cybersecurity. #SSRF #CyberSecurity. |
| 2025-06-27 2025 | Unauthenticated SSRF Vulnerability in Octo STS - CVE-2025-52477. Update to version 0.5.3 or later to protect against SSRF attacks and safeguard sensitive data. Read more: #SSRF #CVE202552477 #CyberSecurity #Vulert #PatchNow news | An unauthenticated SSRF vulnerability (CVE-2025-52477) in Octo STS is identified. To safeguard sensitive data, update to version 0.5.3 or later. Protect against SSRF attacks by applying the patch promptly. Stay informed about cybersecurity threats and vulnerabilities. #SSRF #CVE202552477 #CyberSecurity #Vulert #PatchNow. |
| 2025-06-25 2025 | we exploited an SSRF vulnerability leading to internal port enumeration. Watch our deep dive and walkthrough: youtu.be/wjQrAsQgL2c #BugBounty #hackerone #BugBountytips #CyberSecurity #ssrf intermediate | The content discusses exploiting a Server-Side Request Forgery (SSRF) vulnerability to perform internal port enumeration. A deep dive and walkthrough of the exploit are provided in a video linked at youtu.be/wjQrAsQgL2c. The post includes hashtags related to Bug Bounty, HackerOne, Bug Bounty tips, Cybersecurity, and SSRF. The focus is on demonstrating the exploitation of the vulnerability for educational and security awareness purposes. |
| 2025-06-25 2025 | Just solved another @theXSSrat lab! This time we exploited an SSRF vulnerability leading to internal port enumeration. Watch our deep dive and walkthrough: youtu.be/wjQrAsQgL2c More lab solutions coming soon stay tuned! #SSRF #Cybersecurity #BugBounty intermediate | A cybersecurity enthusiast successfully exploited an SSRF vulnerability in an @theXSSrat lab, showcasing internal port enumeration. A deep dive and walkthrough video of the exploit is available at youtu.be/wjQrAsQgL2c. More lab solutions are on the way, so followers are encouraged to stay tuned for updates. The post highlights the importance of SSRF awareness in cybersecurity and bug bounty hunting. |
| 2025-06-24 2025 | SSRF XSS via PDF Generator 1 App accepts user URLs renders them to PDF (server-side) 2 Attacker hosts HTML with 3 App fetches malicious page and renders it 4 PDF preview opens with embedded JS SSRF turns into stored XSS #bugbounty #ssrf intermediate | The content discusses a security vulnerability where a PDF generator application accepts user URLs, rendering them to PDF server-side. An attacker can exploit this by hosting malicious HTML, tricking the app to fetch and render it, leading to a PDF preview with embedded JavaScript. This vulnerability allows Server-Side Request Forgery (SSRF) to escalate into Stored Cross-Site Scripting (XSS). The issue is highlighted for bug bounty purposes. |
| 2025-06-23 2025 | Weekly Security Sync Complete! This week we dived into the process approach & working of SSRF (Server-Side Request Forgery) No charges just pure knowledge! Call/Message Us 91-8790407216 Email cubeesec.group@gmail.com #ssrf #infosec #bugbounty beginner | The content highlights the completion of the Weekly Security Sync focusing on SSRF (Server-Side Request Forgery), offering knowledge without charges. Contact details for further information are provided. The post emphasizes the importance of understanding SSRF in the context of information security and bug bounty programs. |
| 2025-06-23 2025 | Weekly Security Sync Complete! This week we dived into the process approach & working of SSRF (Server-Side Request Forgery) No charges just pure knowledge! 91-8790407216 cubeesec.group@gmail.com #cybersecurity #ssrf #infosec #bugbounty beginner | The content discusses the completion of the weekly security sync focusing on SSRF (Server-Side Request Forgery). It emphasizes sharing knowledge without any charges, providing contact information for further inquiries. The post includes hashtags related to cybersecurity, SSRF, infosec, and bug bounty. The main points are the exploration of SSRF processes, approach, and operations, along with contact details for cubeesec.group. |
| 2025-06-22 2025 | SSRF via Image URL Upload 1 App fetches metadata from user-supplied image URLs 2 Payload: http://169(.)254(.)xx.xx/latest/meta-data/ 3 No outbound request filtering 4 Internal AWS metadata leaked Image URL Internal network access #bugbounty #ssrf intermediate | The content discusses a security vulnerability known as SSRF (Server-Side Request Forgery) through image URL upload. Key points include an app fetching metadata from user-supplied image URLs, a payload example leading to internal AWS metadata leakage, lack of outbound request filtering, and the risk of granting internal network access through image URLs. The post highlights the potential for exploiting this vulnerability for bug bounty rewards and includes relevant hashtags. |
| 2025-06-21 2025 | This is how top hunters earn $500 $1K even $5K per bug. #BugBounty #ReconTips #XSS #SSRF #IDOR #AssetDiscovery #WebSecurity #InfoSec #EthicalHacking #RedTeam #HackerWorkflow beginner | Top hunters in bug bounty programs can earn significant rewards, ranging from $500 to $5K per bug. They utilize various techniques like ReconTips, XSS, SSRF, IDOR, AssetDiscovery, and focus on WebSecurity, InfoSec, EthicalHacking, RedTeam, and HackerWorkflow. These experts leverage their skills to identify vulnerabilities and report them to organizations for rewards. |
| 2025-06-20 2025 | SSRF: Server-Side Request Forgery Trick the server into calling internal services for you. Simple trick massive damage. Bypass firewalls Access internal IPs Steal cloud metadata #SSRF #cybersecurity #bugbounty #websecurity #cloudsecurity #ethicalhacking #infosec beginner | The content discusses SSRF (Server-Side Request Forgery), a technique to trick servers into accessing internal services, potentially causing significant damage. It highlights the ability to bypass firewalls, access internal IPs, and steal cloud metadata. The post emphasizes the seriousness of SSRF in cybersecurity, bug bounty programs, web security, cloud security, ethical hacking, and information security. The content warns about the risks associated with SSRF and the importance of safeguarding against such vulnerabilities. |
| 2025-06-19 2025 | Day 43: CSRF SSRF & Clickjacking Attacks Security is often broken not by what users do but by what their browsers or servers are tricked into doing. Todays deep dive covered 3 trust-based web attacks #CyberSecurity #WebSecurity #CSRF #SSRF #Clickjacking beginner | The content discusses CSRF, SSRF, and Clickjacking attacks, highlighting that security breaches often occur due to actions tricked browsers or servers take, rather than user actions. The focus is on trust-based web attacks, emphasizing the importance of cybersecurity measures. The post aims to raise awareness about these threats and their implications for web security. |
| 2025-06-19 2025 | @yousukezan . This causes content controlled by the attacker () to be served through the victim's domain (). #SSRF #SecurityFlaw intermediate | The content discusses a security flaw known as Server-Side Request Forgery (SSRF), where an attacker can manipulate a server to serve content through a victim's domain. This poses a risk as the attacker can control the content being served. The tweet mentions @yousukezan and includes a link for more information on the SSRF vulnerability. |
| 2025-06-19 2025 | A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare allows unauthenticated users to proxy arbitrary remote content via /_next/image endpoint. Update to v1.3.0. #SSRF #Cloudflare #NextJS #Cybersecurity #Vulnerability news | A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare enables unauthenticated users to proxy remote content via /_next/image endpoint. Update to v1.3.0 to address the vulnerability. #SSRF #Cloudflare #NextJS #Cybersecurity. |
| 2025-06-18 2025 | Finding SSRFs in Azure DevOps - Part 2 #SSRF #AzureDevOps #AzureSecurity #DNSRebinding #SourceCodeDebugging binsec.no/posts/2025/05/ intermediate | The content discusses the identification of Server-Side Request Forgery (SSRF) vulnerabilities in Azure DevOps, focusing on Azure Security, DNS Rebinding, and Source Code Debugging. It is part 2 of a series and provides insights into detecting SSRFs within Azure DevOps environments. The article can be found on binsec.no/posts/2025/05/. |
| 2025-06-18 2025 | SSRF via PDF Generator 1 App fetches URLs to generate PDFs (e.g. invoices reports) 2 Attacker supplies internal URL (e.g. http://localhost/admin) 3 PDF engine fetches it server-side 4 Leaks internal content in rendered PDF SSRF data exposure #bugbounty #ssrf intermediate | The content discusses a security vulnerability known as Server-Side Request Forgery (SSRF) via a PDF Generator app. The vulnerability allows an attacker to supply internal URLs, which the PDF engine fetches server-side, leading to the leakage of internal content in the generated PDFs. This SSRF issue results in data exposure. The post highlights the risk posed by this vulnerability and suggests it as a target for bug bounty programs. |
| 2025-06-16 2025 | 4 #GeoServer 2.24.4 and 2.25.2 vulnerable to #SSRF via demo request if Proxy Base URL unset. Update to stay protected (Reference: CVE-2024-29198) news | GeoServer versions 2.24.4 and 2.25.2 are susceptible to Server-Side Request Forgery (SSRF) attacks through demo requests when the Proxy Base URL is not set. To mitigate this vulnerability, users are advised to update their GeoServer installations. The reference for this issue is CVE-2024-29198. |
| 2025-06-15 2025 | Hunting for SSRF? Try manipulating URLs in your app (think image uploads webhooks) to target internal IPs (127.0.0.1 192.168.x.x). See if the server leaks internal info or allows unauthorized actions! #SSRF #WebSecurity beginner | The content discusses hunting for Server-Side Request Forgery (SSRF) vulnerabilities by manipulating URLs in applications to target internal IPs like 127.0.0.1 and 192.168.x.x. This can reveal if the server leaks internal information or allows unauthorized actions. The focus is on testing web security by exploiting potential SSRF issues related to image uploads and webhooks. #SSRF #WebSecurity. |
| 2025-06-14 2025 | URL schemes: Not all links are http:// or https:// Some can be dangerous #URL #BugBounty #BugBountytips #XSS #SSRF #OpenRedirect beginner | The content discusses URL schemes, highlighting that not all links are safe with the common http:// or https:// prefixes. Some URLs can be dangerous, posing risks such as XSS, SSRF, and Open Redirect vulnerabilities. The post emphasizes the importance of being cautious with URLs and understanding potential security threats associated with different URL schemes. It also suggests that users should be vigilant, especially in the context of Bug Bounty programs. |
| 2025-06-14 2025 | SSRF Hunting 101: Can you trick a server into making requests for you? Look for URLs or endpoints that accept URLs as input. Try local IPs (127.0.0.1) internal services or metadata endpoints. #SSRF #WebSec beginner | The content discusses SSRF (Server-Side Request Forgery) hunting by tricking a server into making requests for the attacker. It suggests looking for URLs or endpoints that accept URLs as input, trying local IPs like 127.0.0.1, internal services, or metadata endpoints. The focus is on exploiting vulnerabilities to manipulate servers into making unauthorized requests. The content also includes hashtags related to SSRF and Web Security. |
| 2025-06-13 2025 | #ThreatProtection #CVE-2025-4123 #Grafana #XSS and Full-Read #SSRF #vulnerability read more about Symantec's protection: broadcom.com/support/securi news | The content highlights a vulnerability related to Grafana, specifically XSS and SSRF, identified as CVE-2025-4123. It suggests learning more about Symantec's protection measures for this threat by visiting broadcom.com/support/security. The post emphasizes the importance of threat protection and directs readers to further information on safeguarding against these vulnerabilities. |
| 2025-06-13 2025 | Good old 127.1 #ssrf beginner | The content mentions "Good old 127.1" and includes the hashtag #ssrf and a link (https://ift.tt/c6F4K0p). The term "127.1" is often used to refer to the loopback address in networking (127.0.0.1). The hashtag #ssrf could be related to Server-Side Request Forgery, a type of vulnerability. The link provided may lead to further information or resources related to these topics. |
| 2025-06-11 2025 | Beware of the silent danger - SSRF! It can turn your own server into a weapon against you! Understand its mechanisms and secure your network. Stay informed about this #OWASP Top 10 vulnerability! #WebSecurity #SSRF beginner | The content warns about SSRF, a silent danger that can make your server a weapon against you. Understanding SSRF mechanisms is crucial to secure your network. Stay informed about this OWASP Top 10 vulnerability to enhance web security and protect against SSRF attacks. #WebSecurity #SSRF. |
| 2025-06-11 2025 | SSRF Redis RCE 1 App fetches URLs from user input (no whitelist) 2 Attacker targets (Redis) 3 Sends payload to write cron job or web shell 4 Redis accepts raw commands code execution SSRF open Redis = full server pwn #bugbounty #ssrf #rce intermediate | The content discusses a security vulnerability known as SSRF leading to Redis Remote Code Execution (RCE). The vulnerability arises from an application fetching URLs from user input without a whitelist. An attacker can exploit this by targeting Redis, sending a payload to execute commands like writing a cron job or web shell. Since Redis accepts raw commands, this can lead to code execution. The combination of SSRF and an open Redis server can result in a full server compromise. The post highlights the severity of the bug and mentions relevant hashtags like #bugbounty, #ssrf, and #rce. |
| 2025-06-10 2025 | Magoo a Python-based tool for SSRF (Server-Side Request Forgery) vulnerability hunting and unauthorized port scanning. github.com/JoshuaProvoste #BugBounty #Hacking #SSRF intermediate | Magoo is a Python tool designed for finding SSRF vulnerabilities and conducting unauthorized port scanning. It is available on GitHub under the username JoshuaProvoste. The tool is useful for Bug Bounty programs and hacking activities related to SSRF. It can assist in identifying security weaknesses in web applications by testing for SSRF vulnerabilities and scanning for open ports without authorization. |
| 2025-06-10 2025 | SSRF attacks simplified. This post breaks down how attackers target EC2 metadata and how to stay a step ahead. Cyber doesnt have to feel complicated. Follow @Cytrusst for weekly security insights that just make sense. #CyberSecurity #CloudSecurity #SSRF #Infosec #Cytrusst beginner | This content simplifies SSRF attacks, explaining how attackers target EC2 metadata and how to prevent them. It emphasizes making cybersecurity less complex. Follow @Cytrusst for straightforward security insights. Key hashtags: #CyberSecurity #CloudSecurity #SSRF #Infosec #Cytrusst. |
| 2025-06-09 2025 | Found a critical SSRF during a pentest. PDF export accepted raw HTML so I injected an intermediate | A critical Server-Side Request Forgery (SSRF) vulnerability was discovered during a penetration test. The vulnerability was found in a PDF export feature that accepted raw HTML input, allowing for injection of malicious code. |
| 2025-06-09 2025 | @_curious_Dev_ Great question! Input validation & whitelisting are key first steps. Also consider using a proxy server to control outbound requests and limit access to internal resources. #SSRF #webappsecurity intermediate | The content emphasizes the importance of input validation, whitelisting, and using a proxy server for web application security. These measures help prevent security vulnerabilities like Server-Side Request Forgery (SSRF) by controlling outbound requests and limiting access to internal resources. By implementing these steps, developers can enhance the security of their web applications. |
| 2025-06-08 2025 | I completed the Web Security Academy lab: SSRF with blacklist-based input filter. This was fun and surprisingly easy #cybersecurity #portswigger #SSRF @WebSecAcademy @ireteeh @Cyblackorg portswigger.net/web-security/s intermediate | The content discusses completing a Web Security Academy lab on SSRF with a blacklist-based input filter, finding it fun and surprisingly easy. The post includes hashtags related to cybersecurity and mentions of PortSwigger, Web Security Academy, and other relevant accounts. The link provided likely leads to additional information or resources related to the lab completion. |
| 2025-06-08 2025 | @sushicomabacate Já o SSRF permite que o invasor manipule a aplicação para realizar requisições HTTP maliciosas em nome do servidor acessando recursos internos da rede que não estão expostos publicamente. Isso pode comprometer serviços de banco de dados ou APIs internas. #SSRF beginner | The content discusses SSRF (Server-Side Request Forgery), where attackers manipulate applications to make malicious HTTP requests on behalf of the server, accessing internal network resources not publicly exposed. This vulnerability can compromise internal database services or APIs. The post highlights the risks associated with SSRF attacks and provides a link for further information. |
| 2025-06-06 2025 | Day 18 Full-Time Bug Bounty - Learned some cool stuff in JavaScript today starting to really get how things work behind the scenes. - Found a possible SSRF on a public H1 program hope its not a dupe Total Report Payouts: $0 #BugBounty #SSRF beginner | Day 18 of full-time bug bounty work involved learning about JavaScript intricacies and discovering a potential SSRF on a public H1 program. The individual is gaining a deeper understanding of how things operate behind the scenes. The total report payouts for the day were $0. #BugBounty #SSRF. |
| 2025-06-06 2025 | SSRF Cloud Metadata 1 URL input not properly validated 2 Attacker sends request to 3 Server-side request fetches cloud credentials 4 Credentials used to access internal services or take over infra #SSRF Cloud hack #BugBounty beginner | The content discusses a Server-Side Request Forgery (SSRF) vulnerability where the URL input is not validated correctly. An attacker can exploit this by sending a request, allowing them to retrieve cloud credentials through a server-side request. These credentials can then be used to access internal services or take control of the infrastructure. The post highlights the potential for SSRF to lead to a cloud hack and mentions it as a target for Bug Bounty programs. |
| 2025-06-05 2025 | New video out! Bypassed SSRF filters using internal routing logic. Blacklist? Useless. Accessed internal services via crafted requests. Watch the full breakdown youtu.be/4WOlWBXLI-A #SSRF #WebSecurity #BugBounty #InfoSec #Hacking #CyberSecurity intermediate | A new video demonstrates bypassing SSRF filters using internal routing logic, rendering blacklists ineffective. The video showcases accessing internal services through crafted requests. The full breakdown is available at the provided link. The content focuses on SSRF, web security, bug bounty, infosec, hacking, and cybersecurity. |
| 2025-06-05 2025 | SSRF Hunting 101: Can you make the server request itself (or internal resources) via a URL? Try manipulating parameters meant for external APIs. If it works you've got SSRF! #SSRF #WebSecurity beginner | The content discusses SSRF (Server-Side Request Forgery) hunting by attempting to make the server request itself or internal resources via a URL. It suggests manipulating parameters intended for external APIs to test for SSRF vulnerabilities. If successful, it indicates the presence of SSRF, a security risk. The post emphasizes the importance of web security and provides a basic guide for identifying SSRF issues. #SSRF #WebSecurity. |
| 2025-06-04 2025 | Our researchers discovered a critical SSRF XSS chain: 1.SSRF abused to fetch internal JS endpoint 2.Injected payload reflected in an internal admin panel 3.Admin loads it via advanced | Researchers found a significant security vulnerability involving SSRF and XSS. The exploit chain involved abusing SSRF to access an internal JS endpoint, injecting a payload that appeared in an internal admin panel, and then being loaded by an admin. This chain highlights the potential risks of SSRF and XSS vulnerabilities when combined, showcasing how attackers can exploit these weaknesses to gain unauthorized access to internal systems. |
| 2025-06-04 2025 | #Cycatz #cybersecurity Blind SSRF More.... shorturl.at/K2uOY #cyberattacksurfacemanagement #darkwebmonitoring #SurfaceWebMonitoring #mobilesecurity #emailsecurity #cloudsecurity #governanceriskcompliance #vendorriskmanagement #brandmonitoring #incedentreport #bug #SSRF beginner | The content discusses various aspects of cybersecurity, including Blind SSRF, cyber attack surface management, dark web monitoring, mobile security, email security, cloud security, governance risk compliance, vendor risk management, brand monitoring, incident reporting, bugs, and SSRF. It emphasizes the importance of these elements in maintaining robust cybersecurity measures. The provided link likely leads to more detailed information on these topics. |
| 2025-06-04 2025 | New Grafana Exploit CVE-2025-4123 XSS SSRF Open redirect Account Hijack A full exploit chain that breaks Grafana wide open! Watch the full breakdown: youtu.be/tf8_Tuj0huQ?si #BugBounty #CyberSecurity #Grafana #XSS #SSRF #CVE2025 intermediate | A new Grafana exploit CVE-2025-4123 has been discovered, involving XSS, SSRF, open redirect, and account hijack vulnerabilities. The exploit chain poses a significant threat to Grafana security. A detailed breakdown of the exploit is available in a video. This discovery is relevant to Bug Bounty programs, Cybersecurity, and Grafana users. The exploit's severity is highlighted by the use of multiple attack vectors. |
| 2025-06-03 2025 | Web Security Alert Explore critical vulnerabilities: SSRF: Exploits server requests to access internal systems. Open Redirects: Facilitate phishing by redirecting users to malicious sites. Dive deeper: #CyberSecurity #WebSecurity #SSRF beginner | The content warns about critical web security vulnerabilities: SSRF exploits server requests to access internal systems, while Open Redirects can facilitate phishing by redirecting users to malicious sites. The message encourages further exploration of cybersecurity topics like SSRF. |
| 2025-06-02 2025 | 2 #Grafana users: Versions before 12.0.1 allow reflected XSS open redirects leading to #SSRF risks. Update ASAP (Reference: CVE-2025-4123). news | Users of Grafana versions prior to 12.0.1 are at risk of reflected XSS and open redirects, which can lead to SSRF vulnerabilities. It is crucial to update to the latest version immediately to mitigate these security risks. The vulnerability is identified as CVE-2025-4123. |
| 2025-06-02 2025 | Esri patches a critical SSRF vulnerability in Portal for ArcGIS allowing unauthenticated remote attackers to bypass protections and access internal services. #Esri #ArcGIS #SSRF #Cybersecurity securityonline.info/critical-ssrf- news | Esri addressed a severe SSRF vulnerability in Portal for ArcGIS, enabling unauthenticated remote attackers to evade security measures and reach internal services. The patch is crucial for preventing unauthorized access. #Esri #ArcGIS #SSRF #Cybersecurity. |
| 2025-06-01 2025 | Hunting for SSRF? Try injecting URLs in parameters! Look for endpoints that fetch data. Test with internal IPs (127.0.0.1) or your own server to see if they're vulnerable. #SSRF #WebSecurity beginner | The content discusses hunting for Server-Side Request Forgery (SSRF) vulnerabilities by injecting URLs in parameters of endpoints that fetch data. It suggests testing with internal IPs like 127.0.0.1 or your own server to check for vulnerability. The focus is on identifying and exploiting SSRF issues for improved web security. #SSRF #WebSecurity. |
| 2025-05-31 2025 | SSRF hunting? Try manipulating URLs in your target app! See if you can force it to make requests to internal resources or external IPs. Watch out for redirects & error messages! #SSRF #WebSecurity beginner | The content suggests using URL manipulation to hunt for Server-Side Request Forgery (SSRF) vulnerabilities in a target application. By manipulating URLs, one can attempt to make the application send requests to internal resources or external IPs. It advises being cautious of redirects and error messages while conducting this testing for SSRF vulnerabilities. The post emphasizes the importance of web security and includes relevant hashtags like #SSRF and #WebSecurity. |
| 2025-05-31 2025 | Great explanation of CSRF vs SSRF Key difference: CSRF is happening more in the browser and directly to the main server. SSRF is happening on the backend (behind the scenes) from one server to the other #infosec #CyberSecurity #csrf #ssrf @snyksec youtu.be/rgDq_Bi64OM?si beginner | The content provides a clear explanation of the key difference between CSRF and SSRF. CSRF occurs more in the browser, affecting the main server directly, while SSRF takes place on the backend between servers. The post emphasizes the importance of understanding these distinctions for information security and cybersecurity. The content is shared with relevant hashtags and a link to a video for further explanation. |
| 2025-05-30 2025 | New Article Alert! Explore UNC2903 Cloud Intrusion TTPs and how they exploited Adminer SSRF for metadata harvesting. Stay informed stay secure. Read now: #CyberWarfareLabs #CloudSecurity #UNC2903 #SSRF #InfoSec #TTPAnalysis #Article news | The content alerts readers to a new article discussing UNC2903 Cloud Intrusion TTPs and their use of Adminer SSRF for metadata harvesting. It emphasizes staying informed and secure in the realm of cybersecurity. The article covers topics like CyberWarfareLabs, Cloud Security, InfoSec, and TTP Analysis. Readers are encouraged to read the full article for more insights and information. |