The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2024-11-24 2024 | @puntopcap: Vulnerabilidad SSRF (Server Side Request Forgery) OWASP API7:2023 - Un peligro creciente para las APIs #SSRF #Ciberseguridad #OWASP #APISecurity #SeguridadEnAPIs beginner | The content discusses the vulnerability SSRF (Server Side Request Forgery) as outlined in OWASP API7:2023, highlighting it as a growing danger for APIs. The tweet emphasizes the importance of addressing this security risk in the context of API security and cybersecurity. The link provided leads to further information on the topic. |
| 2024-11-20 2024 | VulnVanguard: The Wget Gambit: CVE-2024-10524 allows SSRF attacks via shorthand URLs exposing internal servers & data. Patch Wget to 1.25.0 sanitize inputs & avoid shorthand URLs. Dont let Wget become a backdooract now! #Cybersecurity #Wget #SSRF #PatchNow news | The content warns about CVE-2024-10524 enabling SSRF attacks through shorthand URLs, risking internal server exposure. It advises patching Wget to version 1.25.0, sanitizing inputs, and avoiding shorthand URLs to prevent exploitation. Urging immediate action to prevent Wget from becoming a backdoor, the message emphasizes cybersecurity awareness and the importance of patching vulnerabilities promptly. #Cybersecurity #Wget #SSRF #PatchNow. |
| 2024-11-19 2024 | @JFrogSecurity: New 0-Day #CVE in GNU Wget Found: Our team uncovered CVE-2024-10524 a vulnerability that enables phishing #SSRF and #MiTM attacks by exploiting Wget's shorthand URL handling. Patch it now with Wget 1.25.0! Learn more: news | A new 0-Day CVE-2024-10524 in GNU Wget has been discovered by @JFrogSecurity, enabling phishing, SSRF, and MiTM attacks through URL handling. The vulnerability can be patched with Wget 1.25.0. For more information, visit https://twitter.com/JFrogSecurity/status/1858942224647455107. |
| 2024-11-19 2024 | Joyerz5: Just Discovered a Cool SSRF!! Now working to make it Impactful!! Any tips guys? How I Found it? On the Image Upload features there was fetch image from URL guess what? Yes I put burp collaborator Link there and got HTTP DNS response back! It is confirm now! #ssrf #bugbounty intermediate | The content describes a cybersecurity enthusiast, Joyerz5, who discovered a Server-Side Request Forgery (SSRF) vulnerability while testing an image upload feature. By inserting a Burp Collaborator link, they received an HTTP DNS response, confirming the SSRF. Joyerz5 is now seeking tips to maximize the impact of this finding, indicating involvement in bug bounty programs. The post highlights the importance of identifying and exploiting vulnerabilities like SSRF for security testing and rewards. |
| 2024-11-19 2024 | CCBalert: Warning: Critical vulnerability in #Wget. #CVE-2024-10524 CVSS: 9.8. This #0-day vulnerability could lead to phishing server-side request forgery (#SSRF) and man-in-the-middle (#MiTM) attacks. #Patch #Patch #Patch news | A critical vulnerability (#CVE-2024-10524) in #Wget with a CVSS score of 9.8 has been identified, posing risks of phishing, server-side request forgery (#SSRF), and man-in-the-middle (#MiTM) attacks. This #0-day vulnerability requires immediate patching to prevent exploitation. The alert emphasizes the urgency of applying patches to mitigate potential security threats. |
| 2024-11-18 2024 | JFrogSecurity: Critical 0-Day in GNU Wget Found: Our team uncovered #CVE-2024-10524 a vulnerability that enables phishing #SSRF and #MiTM attacks by exploiting Wget's shorthand URL handling. Patch it now with Wget 1.25.0! Learn more: news | A critical 0-Day vulnerability, CVE-2024-10524, was discovered in GNU Wget by JFrogSecurity. This flaw allows for phishing, SSRF, and MiTM attacks through exploiting Wget's URL handling. The recommended action is to patch it immediately with Wget 1.25.0. Further details can be found on JFrogSecurity's Twitter page. |
| 2024-11-18 2024 | InfoSecComm: New Writeup Alert! "SSRF to Internal Port Scanning on Self-Hosted Platform " by JEETPAL is now live on IW! Check it out here: #ssrf #bugbountytips #bugbounty #bugbountywriteup #cybersecurity intermediate | A new writeup titled "SSRF to Internal Port Scanning on Self-Hosted Platform" by JEETPAL has been published on InfoSecComm. The writeup focuses on SSRF vulnerability and internal port scanning. It is available on IW and covers bug bounty tips and cybersecurity. The content can be found on the provided link. #ssrf #bugbountytips #bugbounty #bugbountywriteup #cybersecurity. |
| 2024-11-17 2024 | ProwlSec: SSRF Unleashed How to find and where to find: #BugBounty #bugbountytip #hackers #Pentesting #SSRF #Hacking #HUNTER #Anonymous #Tips #CyberSecurity beginner | The content discusses ProwlSec's release on SSRF exploitation, providing guidance on how and where to find SSRF vulnerabilities. It emphasizes bug bounty tips, hacking, penetration testing, and cybersecurity. The information is shared on Twitter by ProwlSec. |
| 2024-11-11 2024 | bugvsecurity: Unveiling the Dangers of SSRF Attacks! Did you know that a single SSRF vulnerability can allow attackers to gain unauthorized access to your internal network and cloud resources? Read now to stay ahead of cyber threats #CyberSecurity #SSRF beginner | The content discusses the dangers of Server-Side Request Forgery (SSRF) attacks, highlighting how a single vulnerability can grant unauthorized access to internal networks and cloud resources. It emphasizes the importance of staying informed about cybersecurity threats. The post encourages readers to read further to enhance their understanding and readiness to combat such cyber threats. #CyberSecurity #SSRF. |
| 2024-11-09 2024 | InfosecMonk: Top 25 #SSRF parameters ?dest={target} ?redirect={target} ?uri={target} ?path={target} ?continue={target} ?url={target} ?window={target} ?next={target} ?data={target} ?reference={target} ?site={target} intermediate | The content discusses the top 25 Server-Side Request Forgery (SSRF) parameters, including examples like ?dest={target}, ?redirect={target}, and ?url={target}. These parameters can be exploited by attackers for SSRF attacks. The list provides insight into common parameters that may be vulnerable to such attacks. The information is shared by InfosecMonk on Twitter. |
| 2024-11-07 2024 | @inj3ct0r: #0day #SmartAgent 1.1.0 Server-Side Request Forgery #Vulnerability #SSRF news | The content highlights a Server-Side Request Forgery vulnerability in SmartAgent 1.1.0, tagged as a zero-day exploit. The vulnerability allows attackers to manipulate server requests, potentially leading to unauthorized access or data leakage. The information was shared on Twitter by the user @inj3ct0r. |
| 2024-11-05 2024 | Peet28385834: Server-Side Request Forgery in Qualitor (SSRF) | Bugbounty PoC #bugbounty #bugbountytips #ssrf #qualitor #tips #hackerone intermediate | The content discusses a Server-Side Request Forgery (SSRF) vulnerability found in Qualitor, shared as a Bug Bounty Proof of Concept (PoC) by Peet28385834. The post includes relevant hashtags such as #bugbounty, #ssrf, #qualitor, and #hackerone, indicating it is related to bug bounty programs and security testing. The link provided leads to a tweet by Peet28385834 discussing the SSRF vulnerability in Qualitor. |
| 2024-11-04 2024 | @raahul06: Server-Side Request Forgery (SSRF): SSRF vulnerabilities let attackers trick the server into making unauthorized requests to internal resources potentially exposing sensitive data. Implement input validation and strict access controls to prevent this! #SSRF #OWASP #WebSec beginner | The content warns about Server-Side Request Forgery (SSRF) vulnerabilities that allow attackers to manipulate servers into making unauthorized requests to internal resources, risking sensitive data exposure. It advises implementing input validation and strict access controls to mitigate this risk. The message emphasizes the importance of security measures to prevent SSRF attacks in web applications. |
| 2024-11-03 2024 | s41r4j: Server-Side Request Forgery (#SSRF): - #Enumerate internal #networks including IP addresses and ports - Abuse trust relationships between #servers and gain access to otherwise restricted services - Interact with some non-HTTP services to get remote code execution (#RCE) intermediate | The content discusses Server-Side Request Forgery (#SSRF), highlighting its capabilities: - Enumerating internal networks, IP addresses, and ports - Abusing trust relationships between servers to access restricted services - Interacting with non-HTTP services for remote code execution (#RCE). The information is shared via a tweet by s41r4j. |
| 2024-10-31 2024 | s41r4j: #BugBounty vulnerabilities - for beginners: - #XSS - #SQL #injection - #CSRF - #SSRF - #IDOR - Information Disclosure - Directory Transversal - Open Redirect - Web Cache Poisoning beginner | The content discusses various Bug Bounty vulnerabilities for beginners, including XSS, SQL injection, CSRF, SSRF, IDOR, Information Disclosure, Directory Traversal, Open Redirect, and Web Cache Poisoning. The information is shared by s41r4j on Twitter. |
| 2024-10-30 2024 | @CWISociety: Its always a good day to hear about #CWIS #SSRF guidelines from Past Prez @zmbauman. Thanks to #CAMIT for the opportunity! #cwismember beginner | The content highlights a tweet from @CWISociety expressing appreciation for learning about #CWIS #SSRF guidelines from Past President @zmbauman, thanking #CAMIT for the opportunity. The tweet emphasizes the importance of staying informed and connected within the CWIS community. |
| 2024-10-28 2024 | @howdocomputer: Unauth #SSRF & #XSS on news | The content mentions the discovery of unauthorized Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities can potentially allow attackers to manipulate server requests and inject malicious scripts into a website. It is crucial for website owners to address and patch these vulnerabilities to prevent exploitation by malicious actors. |
| 2024-10-28 2024 | @KonwarAbhi98099: Blind SSRF on a Hackerone Program Credit: #$ubh@nk@r #ssrf intermediate | The content mentions a Twitter post by user @KonwarAbhi98099 about discovering a Blind Server-Side Request Forgery (SSRF) vulnerability in a Hackerone program. The post credits the discovery to user #$ubh@nk@r. |
| 2024-10-27 2024 | nmkannans: Common SSRF misconceptions during the interviews - OWASP top 10 #SSRF #bugbountytip #bugbountytips #CyberSecurity beginner | The content discusses common misconceptions about Server-Side Request Forgery (SSRF) during interviews, referencing OWASP top 10. It touches on SSRF-related topics such as bug bounty tips and cybersecurity. The Twitter post by user nmkannans highlights the importance of understanding and addressing SSRF vulnerabilities in the context of cybersecurity. |
| 2024-10-23 2024 | DanaEpp: Check out this article to learn how to find and exploit server-side request forgery (SSRF) vulnerabilities in an API. #apihacking #ssrf intermediate | The content shared by DanaEpp focuses on learning how to identify and exploit server-side request forgery (SSRF) vulnerabilities in an API. The tweet encourages checking out an article for insights into API hacking and SSRF. DanaEpp provides a link to the article for further information on this topic. The post is tagged with #apihacking and #ssrf to highlight the relevance of the content. |
| 2024-10-22 2024 | @davidwillisowen: Huntr is a bug bounty platform designed specifically for AI/ML libraries The top 3 bugs that keep cropping up are LFI RCE and SSRF #hacking #bugbounty #ssrf news | Huntr is a bug bounty platform for AI/ML libraries. The top recurring bugs are LFI, RCE, and SSRF. This information was shared on Twitter by @davidwillisowen. #hacking #bugbounty #ssrf |
| 2024-10-22 2024 | iototsecnews: Plane プロジェクト管理ツールの脆弱性 CVE-2024-47830 が FIXCVSS 値 9.3 の SSRF #OpenSource #Plane #ProjectManagement #SSRF #Vulnerability news | The content discusses a vulnerability (CVE-2024-47830) in the Plane project management tool with a FIXCVSS score of 9.3 due to SSRF. The post highlights the vulnerability in the open-source project management tool and includes relevant hashtags like #OpenSource, #Plane, #ProjectManagement, #SSRF, and #Vulnerability. |
| 2024-10-21 2024 | @grumpzsux: Advanced SSRF via HTTP/2 Frames: Exploit HTTP/2 frame multiplexing to send SSRF payloads to internal services that are otherwise protected. Target servers misconfigured with H2C (HTTP/2 Cleartext) support. #SSRF #HTTP2Exploits #BugBounty advanced | The content discusses exploiting HTTP/2 frame multiplexing for advanced SSRF attacks, targeting servers misconfigured with H2C support. This method allows sending SSRF payloads to internal services that are usually protected. The post highlights the potential vulnerability and encourages awareness of SSRF, HTTP/2 exploits, and bug bounty programs. The information is shared on Twitter by the user @grumpzsux. |
| 2024-10-21 2024 | grumpzsux: Abusing WebSockets for SSRF: Use WebSocket connections to exploit poorly validated Origin headers. Use this to bypass SSRF protections or access internal services behind firewalls. #WebSocketExploitation #SSRF #BugBounty intermediate | The content discusses exploiting WebSockets for SSRF by manipulating poorly validated Origin headers. This can be used to bypass SSRF protections and access internal services behind firewalls. The post highlights the potential security risks and encourages bug bounty hunters to explore WebSocket exploitation for vulnerabilities. The Twitter link provides more details on this topic. #WebSocketExploitation #SSRF #BugBounty. |
| 2024-10-17 2024 | Exfiltrated, Signed, Delivered – What Can Go Wrong When an Amazon Elastic Compute Cloud (EC2) Instance is Exposed to SSRF intermediate 7 min read | Tool embedded in CNAPPgoat demonstrates how Server-Side Request Forgery (SSRF) exposure on an Amazon EC2 instance can be weaponized with exfiltrated credentials to trigger AWS service calls, bypassing standard detection methods. This technique, leveraging tools like Stephen Bradshaw's `aws_url_signer`, allows attackers to generate signed URLs that appear legitimate to the instance, making it crucial for customers to secure deployed applications and prevent SSRF vulnerabilities as part of their shared responsibility. → tenable.com |
| 2024-10-17 2024 | Carrying Out Your First SSRF Attack - Introduction to Server-Side Request Forgery Lesson | QA Platform beginner | The content introduces a lesson on Server-Side Request Forgery (SSRF) attacks on the QA Platform. It encourages individuals to begin learning about SSRF attacks through their digital training solutions. |
| 2024-10-17 2024 | Server-Side Request Forgery (SSRF) beginner 5 min read | Tutorial on Server-Side Request Forgery (SSRF) detailing how attackers can exploit server functionality to send requests from behind firewalls. It covers basic and blind SSRF, impact including metadata API access and local file disclosure, and testing methods using tools like Burp Suite, Burp Collaborator, and DNSBin. Prevention strategies include whitelisting IPs, disabling unnecessary URL schemes like `file://` and `gopher://`, and implementing anomaly detection on outgoing traffic. → intigriti.com |
| 2024-10-17 2024 | Server-Side Request Forgery (SSRF) involves an attacker tricking a server into making unauthorized… beginner | The blog post discusses Server-Side Request Forgery (SSRF), where attackers deceive servers into making unauthorized requests. It covers the definition of SSRF, its impact, how it operates, and basic prevention measures. |
| 2024-10-17 2024 | Let’s Understand SSRF vulnerability beginner | The content provides an introduction to understanding SSRF (Server-Side Request Forgery) vulnerability. SSRF is a type of security vulnerability that allows an attacker to manipulate the server into making unauthorized requests on their behalf. This can lead to data breaches, unauthorized access, and other security risks. Understanding SSRF is crucial for developers and security professionals to prevent and mitigate such vulnerabilities in web applications. → infosecwriteups.com |
| 2024-10-17 2024 | 👩💻Roadmap to Cybersecurity in 2022, Full-Read SSRF, IDOR in GraphQL, GCP Pentesting, and much… news GraphQL | The content discusses a talk focusing on cybersecurity in 2022, covering topics such as SSRF, IDOR in GraphQL, GCP Pentesting, and more. The talk highlights the significant value, over $25 billion, that is at risk due to practical attacks on bridges. It emphasizes the importance of understanding and addressing vulnerabilities in cybersecurity to protect valuable assets. → infosecwriteups.com |
| 2024-10-17 2024 | 👩💻 $600k Bounty, Jetty Features, Response Queue Poisoning, Bypass SSRF Protections, XSS… news Bug Bounty | A $600K bounty was awarded due to a business logic flaw in smart contracts. → infosecwriteups.com |
| 2024-10-17 2024 | Exploiting: SSRF For Admin Access intermediate | The content is about exploiting Server-Side Request Forgery (SSRF) vulnerabilities to gain admin access. SSRF allows attackers to make requests on behalf of the server, potentially accessing internal systems or performing unauthorized actions. By manipulating URLs, attackers can trick the server into fetching sensitive data or executing commands. This can lead to unauthorized access to admin interfaces, compromising the system's security. The article likely discusses the risks of SSRF vulnerabilities, the impact on system security, and potential mitigation strategies to prevent such attacks. → infosecwriteups.com |
| 2024-10-17 2024 | Server-Side Request Forgery — SSRF: Exploitation Technique beginner | Server-side request forgery (SSRF) is a vulnerability where an attacker can manipulate a server to make unauthorized HTTP requests. This exploitation technique can lead to sensitive data exposure, unauthorized access, and potential server compromise. Preventing SSRF involves input validation, using whitelists, and restricting server access to prevent attackers from exploiting this vulnerability. → infosecwriteups.com |
| 2024-10-17 2024 | Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text intermediate Bug Bounty | The content discusses a successful bug bounty story where the author and a friend earned approximately $2500 from Cafebazaar by exploiting a Server-Side Request Forgery (SSRF) vulnerability on Zimbra, leading to the exposure of all credentials in clear text. → infosecwriteups.com |
| 2024-10-17 2024 | My First Bug: Blind SSRF Through Profile Picture Upload intermediate Bug Bounty | The content is a writeup detailing the discovery of the author's first bug, which involves a blind Server-Side Request Forgery (SSRF) vulnerability through profile picture upload. The author likely shares their experience, the steps taken to identify the bug, and the impact of the vulnerability. This bug could potentially allow an attacker to manipulate the server into making requests on their behalf, leading to unauthorized access or data leakage. The writeup may also include insights on responsible disclosure and the importance of thorough security testing in web applications. → infosecwriteups.com |
| 2024-10-17 2024 | 10 Types of Web Vulnerabilities that are Often Missed - Labs Detectify beginner 16 min read Bug Bounty | Survey of web vulnerabilities often missed, including HTTP/2 smuggling exploiting header desynchronization and XXE via Office Open XML parsers by crafting malicious OOXML files. It also covers SSRF through XSS in PDF generators, potentially leveraging headless browsers to access internal resources like AWS metadata, and XSS via SVG file uploads. → labs.detectify.com |
| 2024-10-17 2024 | How i found 3 SSRF in one day on different bug bounty targets. intermediate Bug Bounty | The blog discusses the author's approach to bug bounty targets, detailing how they discovered three Server-Side Request Forgery (SSRF) vulnerabilities within 5-6 hours on different targets. The focus is on their successful identification of SSRF vulnerabilities and the speed at which they were able to find them. |
| 2024-10-17 2024 | Server Side Request Forgery — SSRF beginner | Server Side Request Forgery (SSRF) is a web vulnerability that enables attackers to manipulate a server to make unauthorized requests. This issue can lead to data leaks, unauthorized access, and potential server exploitation. Preventing SSRF involves input validation, restricting access to sensitive resources, and using secure coding practices. It is crucial for developers and organizations to be aware of SSRF risks and implement robust security measures to mitigate this threat effectively. → infosecwriteups.com |
| 2024-10-17 2024 | Vimeo SSRF with code execution potential. intermediate RCE | The content discusses the discovery of a semi-responded SSRF vulnerability on Vimeo that potentially allows for code execution. The author shares their process of finding and exploiting this vulnerability in a blog post. → infosecwriteups.com |
| 2024-10-17 2024 | BugBounty | A Simple SSRF intermediate 2 min read Bug Bounty | Writeup details SSRF discovery in a macOS chat client, bypassing initial internal IP restrictions through subdomain brute-forcing. The vulnerability allowed for JavaScript execution via the browser's User-Agent header, enabling bypass of the Same Origin Policy. Techniques include fetching internal network content and using DNS rebinding for further exploitation. |
| 2024-10-17 2024 | SSRF Vulnerability due to Sentry misconfiguration beginner | The content is vague and lacks specific details or information. It mentions a story related to a disclosed report. |
| 2024-10-17 2024 | SVG XLink SSRF fingerprinting libraries version intermediate | SSRF (Server-side request forgery) is a common attack surface, especially in uploading functionalities where applications fetch data. This vulnerability can be exploited by attackers to access internal systems or perform malicious actions. It is important to be aware of SSRF risks and implement proper security measures to prevent such attacks. |
| 2024-10-17 2024 | AWS takeover through SSRF in JavaScript intermediate 7 min read Bug Bounty | Writeup detailing an AWS account takeover achieved via Server-Side Request Forgery (SSRF) in a JavaScript macro language. The vulnerability stemmed from an `eval()` injection within a custom `Union()` function, allowing for unvalidated argument concatenation. Exploiting this, the attacker could trigger HTTP requests using `fetch()`, leading to blind SSRF. By chaining requests, the attacker successfully exfiltrated AWS credentials, resulting in control over numerous S3 buckets and EC2 instances. |
| 2024-10-17 2024 | breacharcom: Server-Side Request Forgery (SSRF) allows attackers to make unauthorized requests from the server potentially accessing internal systems. Protect your apps by validating and sanitizing user input. #SSRF #CyberSecurity #OSCP #OSWE #infosec #offsec #Pentesting #redteam beginner | The content warns about Server-Side Request Forgery (SSRF) enabling unauthorized requests from servers, risking access to internal systems. It advises safeguarding apps by validating and sanitizing user input. The post emphasizes cybersecurity measures and mentions relevant hashtags like #OSCP, #OSWE, #infosec, #offsec, #Pentesting, and #redteam. |
| 2024-10-17 2024 | Server Side Request Forgery (SSRF) Testing intermediate | The content discusses Server Side Request Forgery (SSRF) testing for fun rather than for a bounty. The author discovered a website vulnerable to SSRF but did not exploit it. The focus is on testing and identifying SSRF vulnerabilities in web applications. → infosecwriteups.com |
| 2024-10-17 2024 | How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! advanced 6 min read Bug Bounty RCE | Writeup detailing an exploit chain that achieved Remote Code Execution (RCE) on GitHub Enterprise by chaining four vulnerabilities. This chain began with a Server Side Request Forgery (SSRF) in Webhook, bypassed IP restrictions using RFC 3986 formats, and leveraged a second SSRF in Graphite. Further exploitation involved CR-LF injection to smuggle protocols, specifically targeting Memcached and then exploiting unsafe Ruby Marshal deserialization to trigger RCE. |
| 2024-10-17 2024 | SSRF bible. Cheatsheet beginner | The content is a cheatsheet on Server-Side Request Forgery (SSRF) with revision 1.03 from January 26, 2017. It includes information on basics, typical attack steps, and file descriptions related to SSRF. The authors are from the Wallarm research team, and the cheatsheet is available on their website. Additionally, a new product called Wallarm FAST for security tests from traffic is promoted. → docs.google.com |
| 2024-10-15 2024 | Find SSRF , LFI , XSS using httpx , waybackurls , gf , gau , qsreplace intermediate XSS | The content discusses utilizing tools like httpx, waybackurls, gf, gau, and qsreplace to find SSRF, LFI, and XSS vulnerabilities. These advanced bug bounty tips can aid in bug hunting. The author recommends visiting a website for more information, including videos on advanced subdomain reconnaissance, subdomain takeover, and proof of concept demonstrations. The content encourages readers to begin utilizing these tools for bug bounty hunting. |
| 2024-10-15 2024 | Digging for SSRF in NextJS apps intermediate 6 min read | Library detailing common Server-Side Request Forgery (SSRF) vulnerabilities in NextJS applications, specifically highlighting misconfigurations in the `_next/image` component and Server Actions. It explains how SSRF can be exploited through the `remotePatterns` configuration, SVG XSS or XML response leaks in older versions, and blind SSRF via open redirects on whitelisted domains. Furthermore, it details how SSRF can be achieved by forging the `Host` header when a Server Action redirects to a path starting with `/`, allowing attackers to access internal resources. → assetnote.io |
| 2024-10-15 2024 | Hunting for SSRF Bugs in PDF Generators intermediate 12 min read | Technique for identifying Server-Side Request Forgery (SSRF) vulnerabilities in PDF generators. It details how to inject HTML payloads into contexts like between tags, within apostrophes, or within quotation marks in HTML entity attributes. The technique covers verifying remote resource access, checking for JavaScript execution via `<script>` tags or `onerror` handlers, and discusses exploiting cloud-hosted servers, particularly to interact with AWS IMDS for credential leakage. |