The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2024-10-15 2024 | blackhatethicalhacking/SSRFPwned intermediate 3 min read | Tool for automating Server Side Request Forgery (SSRF) vulnerability testing. SSRFPwned injects custom payloads into query parameters of thousands of URLs, leveraging sources like Wayback Machine, URLScan, and AlienVault for discovery. It filters relevant URLs using GF patterns, checks response codes, and identifies reflected payload traces to report vulnerable endpoints. |
| 2024-10-15 2024 | assetnote/surf intermediate 2 min read | Tool for discovering Server-Side Request Forgery (SSRF) candidates by probing hosts with HTTP requests. It identifies both externally and internally facing hosts that may be vulnerable to SSRF, even when traditional filters might miss externally accessible internal web applications. The tool utilizes `httpx` for HTTP probing and provides options for concurrency, timeout, and disabling analysis. |
| 2024-10-15 2024 | Th0h0/autossrf intermediate 1 min read | Tool for automated SSRF vulnerability discovery, autoSSRF employs smart fuzzing on relevant GET parameters like `?url=` and `?uri=`, avoiding disruption to the application's original URL interpretation. It generates context-aware dynamic payloads designed to bypass white-listing validations by recognizing potentially authorized hosts. Utilizing ProjectDiscovery's interactsh for out-of-band interactions, autoSSRF achieves high confidence in identifying SSRF vulnerabilities with minimal false positives. |
| 2024-10-15 2024 | assetnote/blind-ssrf-chains advanced 10 min read | Library detailing blind SSRF exploit chains, covering techniques like "SSRF canaries" and identifying internal services via DNS. It discusses proving impact when responses are unreadable, leveraging side channels, and provides specific examples for exploiting vulnerabilities in services such as Elasticsearch, Weblogic (CVE-2014-4210), and Oracle WebLogic Server (CVE-2020-14883). The library also explores pivoting through internal network assets and discovering new internal hosts via DNS permutations. |
| 2024-10-15 2024 | imran-parray/Mind-Maps beginner | The repository contains Mindmaps for bug bounty hunters, pentesters, and security professionals, contributed by the owner and the community. It serves as a resource for offensive and defensive security strategies. |
| 2024-10-15 2024 | incredibleindishell/SSRF_Vulnerable_Lab beginner 4 min read | Library of PHP code demonstrating Server-Side Request Forgery (SSRF) vulnerabilities across six scenarios, including fetching file content, connecting to remote hosts, file downloads (potentially for internal IP enumeration), and bypassing IP blacklisting via DNS spoofing and DNS rebinding. It also includes an example of SSRF in an HTML to PDF generator, with a provided Dockerfile for easy setup and testing. |
| 2024-10-15 2024 | swisskyrepo/SSRFmap intermediate 4 min read | Framework for finding and exploiting Server Side Request Forgery (SSRF) vulnerabilities. SSRFmap takes a Burp request file and a parameter to fuzz, supporting modules for port scanning, reading files, and triggering reverse shells. It includes options for custom user agents, HTTPS endpoints, and payload level adjustments for WAF bypass. The framework also provides Docker support and example requests for testing. |
| 2024-10-13 2024 | spencer_5cent: @Hacker0x01 @prescientsec 2/2 5.If different IP/port combos show different response bodies. You have SSRF. 6. If you see CONSISTENT differences in response times for certain ports/IPs you have Blind SSRF. #ssrf @SynackRedTeam intermediate | The content discusses SSRF (Server-Side Request Forgery) detection methods shared by spencer_5cent on Twitter. It mentions that if different IP/port combinations yield different response bodies, it indicates SSRF. Additionally, consistent variations in response times for specific ports/IPs suggest Blind SSRF. The tweet includes the hashtag #ssrf and mentions @SynackRedTeam. |
| 2024-10-13 2024 | InfoStratosally: Beware of SSRF: A silent threat where attackers manipulate servers to access sensitive data or internal systems. Strengthen your defenses by validating inputs and restricting access! #Cybersecurity #SSRF #DataProtection beginner | The content warns about SSRF (Server-Side Request Forgery), a threat where attackers manipulate servers to access sensitive data or internal systems. It emphasizes the importance of strengthening defenses by validating inputs and restricting access to mitigate this risk. The post underscores the significance of cybersecurity measures and data protection in safeguarding against SSRF attacks. |
| 2024-10-11 2024 | PHP SSRF Techniques intermediate | The content discusses PHP Server-Side Request Forgery (SSRF) techniques focusing on bypassing security measures like filter_var(), preg_match(), and parse_url(). It likely covers methods to manipulate input data to exploit vulnerabilities in these functions, potentially allowing attackers to make unauthorized requests from the server. The content may provide insights into how attackers can circumvent these common PHP functions to carry out SSRF attacks. |
| 2024-10-11 2024 | GitLab Patches Pipeline Execution SSRF XSS Vulnerabilities news 1 min read | Library updates from GitLab address eight vulnerabilities in Community and Enterprise Edition releases. These include critical pipeline execution flaws like CVE-2024-9164 and CVE-2024-8970, a server-side request forgery (SSRF) impacting Product Analytics Dashboard, and a cross-site scripting (XSS) bug in application authorization. Additional fixes cover merge request diff viewing issues, deploy key vulnerabilities, guest user project template disclosure, and instance version disclosure. → securityweek.com |
| 2024-10-11 2024 | “When Logs Speak: The SSRF Chronicles” beginner | Hello Hunters, |
| 2024-10-08 2024 | @S_Sasili: Simple script to chain SSRF issues with arbitrary HTTP redirect (with auth header) to trigger leaking sensitive headers. #Cybersecurity #InfosecTools #EthicalHacking #PenTesting #CTF #VulnerabilityHunting #SSRF #bugbountytips #bugbountytools #SecurityResearch #bugbounty intermediate | The content discusses a simple script created by @S_Sasili that chains SSRF vulnerabilities with arbitrary HTTP redirects, using an authentication header to expose sensitive headers. The script aims to aid in cybersecurity, ethical hacking, penetration testing, CTF challenges, vulnerability hunting, and bug bounty programs. It highlights the importance of security research and provides tools for bug bounty hunters. The script's purpose is to demonstrate a technique for exploiting SSRF vulnerabilities to leak sensitive information. The link provided directs to the original tweet by @S_Sasili. |
| 2024-10-08 2024 | redfoxsec: Understanding Server-Side Request Forgery (SSRF)! Explore this critical vulnerability that allows attackers to manipulate web apps into unauthorized requests. Learn how SSRF can: Access internal resources Bypass security measures #SSRF #CyberSecurity beginner | The content discusses Server-Side Request Forgery (SSRF), a critical vulnerability that enables attackers to manipulate web apps for unauthorized requests. SSRF allows access to internal resources and bypasses security measures. This vulnerability poses a significant threat to cybersecurity. #SSRF #CyberSecurity. |
| 2024-10-08 2024 | mutantera0: Simple script to chain SSRF issues with arbitrary HTTP redirect (with auth header) to trigger leaking sensitive headers. Github: #Cybersecurity #InfosecTools #EthicalHacking #PenTesting #CTF #VulnerabilityHunting #SSRF #bugbountytips #bugbountytools intermediate | The content discusses a script called mutantera0 that chains SSRF issues with an arbitrary HTTP redirect using an auth header to expose sensitive headers. The script is available on GitHub and is relevant to cybersecurity, ethical hacking, penetration testing, CTF challenges, vulnerability hunting, and bug bounty programs. The focus is on exploiting SSRF vulnerabilities to leak sensitive information. The Twitter link provides more details. |
| 2024-10-01 2024 | Eth1calHackrZ: 11/14 Educate #Yourself: Understanding how #attacks like #SSRF and #XSS work can better prepare you for defending against them. #KnowledgeIsPower #CyberEducation beginner | The content emphasizes the importance of educating oneself on attacks like SSRF and XSS to enhance defense strategies. It highlights the significance of knowledge in cybersecurity and encourages individuals to learn about these attack methods for better preparedness. The tweet suggests that understanding how these attacks work can empower individuals to defend against them effectively. Eth1calHackrZ promotes the idea that education is key in the realm of cybersecurity. |
| 2024-10-01 2024 | @Eth1calHackrZ: 5/14 Universal #Exploit: #Manipulating the "x-forwarded-proto" header led to #fullresponse #SSRF and #XSS across all "@netlify/ipx" setups. Learn how! #CyberAttack #Web3Vulnerabilities intermediate | The content discusses a universal exploit discovered by @Eth1calHackrZ on 5/14 involving manipulating the "x-forwarded-proto" header, leading to full response SSRF and XSS vulnerabilities across all "@netlify/ipx" setups. The post highlights the potential cyber attack risks and web vulnerabilities associated with this exploit. It encourages learning more about the exploit and its implications. |
| 2024-10-01 2024 | @Eth1calHackrZ: 4/14 Image Optimization Gone Wrong: Delve into how "@netlify/ipx" allowed #SSRF & #XSS attacks due to improper #URL parsing. #ServerSideRequestForgery #CrossSiteScripting #NetlifySecurity intermediate | The content discusses a security issue with "@netlify/ipx" that led to SSRF and XSS attacks due to improper URL parsing. The tweet highlights the vulnerability and mentions the hashtags #ServerSideRequestForgery, #CrossSiteScripting, and #NetlifySecurity. The post warns about the risks associated with image optimization gone wrong. |
| 2024-09-29 2024 | SandroBruscino: This article explains how DNS rebinding can bypass SSRF filters. Even 1 in 30 successful requests can be a game changer! #CyberSecurity #SSRF #DNSRebinding intermediate | The article by SandroBruscino discusses how DNS rebinding can circumvent SSRF filters, highlighting the significance of even a small success rate. This has implications for cybersecurity, emphasizing the potential impact of this technique. The tweet provides a link to the article for further information. |
| 2024-09-29 2024 | @nmkannans: As a part of my python learning created this python exploit script to run #SSRF port scans in a vulnerable Web / API endpoint that allows parameters in the request body -- #CyberSec #BugBounty #Pentesting #CyberSec #Security intermediate | The content discusses the creation of a Python exploit script by @nmkannans for running SSRF port scans on a vulnerable Web/API endpoint that accepts parameters in the request body. The script is part of the author's Python learning journey and is shared in the context of cybersecurity, bug bounty programs, pentesting, and general security awareness. The script's purpose is to identify security vulnerabilities in web applications. |
| 2024-09-29 2024 | Bypassing Filters: SSRF Exploitation via DNS Rebinding with Just 1 in 30 Successful Requests intermediate | Hey everyone, hope you’re all doing well! I wanted to share a cool bug story I came across a few months ago. It’s about an SSRF… |
| 2024-09-27 2024 | Payloads/ssrf.txt at main · 1BlackLine/Payloads beginner 1 min read Bug Bounty | List of Server-Side Request Forgery (SSRF) payloads featuring common IP addresses like `localhost`, `127.0.0.1`, and the `0.0.0.0` broadcast address. Includes examples for different protocols such as HTTP, SMTP, SSH, Squid, `jar`, `file`, `sftp`, `ldap`, `netdoc`, `gopher`, and `dict` schemes. The collection also covers various encoding techniques, IPv6 addresses, and specific cloud metadata endpoints like AWS (`169.254.169.254`) and Google Cloud (`metadata.google.internal`). |
| 2024-09-26 2024 | @MrD3fu1t: @Medium @bountywriteups @Hacker0x01 @Bugcrowd @github Some Moment Ago I visited for Read a writeup about #xss #lfi #ssrf from @Medium when i submit that writeup link to Freedium for bypass paywall. its show Me XSS Vulnerability. news | The content mentions a Twitter post by @MrD3fu1t where they visited Medium to read about XSS, LFI, and SSRF. They submitted the writeup link to Freedium to bypass a paywall, revealing an XSS vulnerability. The post includes tags for various platforms like HackerOne, Bugcrowd, and GitHub. |
| 2024-09-26 2024 | reverseame: SSRFing the Web with the Help of Copilot Studio #SSRF #Microsoft #CopilotStudio #Vulnerability #Critical intermediate | The content discusses SSRF (Server-Side Request Forgery) vulnerabilities in web applications, specifically using Copilot Studio from Microsoft to exploit them. The focus is on the critical nature of these vulnerabilities and their potential impact. The tweet highlights the importance of understanding and addressing SSRF vulnerabilities in web security. |
| 2024-09-25 2024 | cyber24x7: 10. #ThreatPatrol a #Python script based tool that can scan websites for #vulnerabilities including #SQLinjection #XSS #CSRF #SSRF #LFI and #RCE. beginner | The content discusses cyber24x7's #ThreatPatrol, a Python script tool that scans websites for vulnerabilities like SQL injection, XSS, CSRF, SSRF, LFI, and RCE. The tool aims to enhance website security by identifying and addressing these potential threats. The tool's capabilities are highlighted in a tweet from cyber24x7. |
| 2024-09-25 2024 | prod42net: Unlocking SSRF potential with Peppa's insights on finding ports beyond 9001. Scan 1-65535 for valid ports watch for img tag in responses. #CyberSecurity #SSRF #PortScanning intermediate | The content discusses utilizing SSRF to find ports beyond 9001 by scanning 1-65535 for valid ports and monitoring responses for img tags. Peppa's insights are highlighted for unlocking SSRF potential. The post emphasizes cybersecurity, SSRF, and port scanning. The link provided leads to the original tweet on Twitter. |
| 2024-09-25 2024 | @prod42net: Peppa's latest on CBJS: SSRF 2 reveals how to access admin.php decode base64 content & display in image tag for easy reading. Don't miss this encryption tip! #CyberSecurity #SSRF #Encryption intermediate | Peppa's latest post on SSRF 2 discusses accessing admin.php, decoding base64 content, and displaying it in an image tag for easier reading. The content emphasizes an encryption tip related to cybersecurity and SSRF. The post is shared on Twitter by @prod42net. |
| 2024-09-22 2024 | Ke_Cyber: Don't wait for a breachsecure your site NOW before its too late! #CyberSecurity #WordPress #Kenya #DataBreach #SSRF #XSS #SQLi #GovtSites #InfoSec #UpdateNow #SecurityThreat beginner | The content emphasizes the urgency of securing websites to prevent data breaches. It highlights the importance of taking action immediately to protect against security threats like SSRF, XSS, and SQLi. The message targets WordPress users in Kenya and government sites, urging them to update their security measures promptly. The post stresses the significance of proactive cybersecurity measures to avoid potential breaches. |
| 2024-09-20 2024 | true_redfence: INFORMATIONOffensive Security Tool: SSRFPwned SSRFPwned is developed by Chris Abou-Chabké from Black Hat Ethical Hacking. It is a tool that automates the process of testing for Server-Side Request Forgery (SSRF) #ssrf #offensivesecurity beginner | SSRFPwned is an offensive security tool created by Chris Abou-Chabké from Black Hat Ethical Hacking. It automates testing for Server-Side Request Forgery (SSRF). The tool is designed to assist in identifying and addressing SSRF vulnerabilities efficiently. It aims to enhance offensive security practices by streamlining the SSRF testing process. |
| 2024-09-19 2024 | JaneParrish: #News: @ProtectAICorp's Vulnerability Report uncovers 20 #security #flaws in #opensource #tools used for building #AI/#ML systems - incl Remote Code Execution #RCE in BerriAI/litellm password reset in lunary-ai/lunary and #SSRF in gradio-app/gradio news | @ProtectAICorp's Vulnerability Report reveals 20 security flaws in open-source tools for AI/ML systems. Issues include Remote Code Execution in BerriAI/litellm, password reset vulnerability in lunary-ai/lunary, and Server-Side Request Forgery in gradio-app/gradio. This poses risks to the security of AI projects. |
| 2024-09-19 2024 | iototsecnews: Ivanti EPM の脆弱性 CVE-2024-29847 などが FIXRCE が生じる恐れ #IvantiCloudServiceAppliance #IvantiCSA #IvantiEndpointManagement #IvantiEPM #IvantiWorkspaceControl #IWC #RCE #SSRF #Vulnerability #ZeroDay news | The content discusses a vulnerability (CVE-2024-29847) in Ivanti EPM that could lead to a Remote Code Execution (RCE) issue. It mentions hashtags related to Ivanti products and security terms like SSRF, Vulnerability, and ZeroDay. The post warns about the potential risk posed by this vulnerability. |
| 2024-09-18 2024 | Cybersleuth254: Found an SSRF vulnerability using a custom Nuclei template! This bug allows attackers to inject malicious URLs and access sensitive data on the server. #Cybersecurity #SSRF #BugBounty #PenTesting #Infosec #Nuclei intermediate | Cybersleuth254 discovered an SSRF vulnerability using a custom Nuclei template, enabling attackers to inject malicious URLs and access sensitive server data. The finding highlights the importance of cybersecurity measures like bug bounties, penetration testing, and information security. #Cybersecurity #SSRF #BugBounty #PenTesting #Infosec #Nuclei. |
| 2024-09-18 2024 | Cybersleuth254: Found an SSRF vulnerability using a custom Nuclei template! This bug allows attackers to inject malicious URLs and access sensitive data on the server. Always validate inputs to prevent these threats! #Cybersecurity #SSRF #BugBounty #PenTesting #Infosec #Nuclei intermediate | Cybersleuth254 discovered an SSRF vulnerability using a custom Nuclei template, enabling attackers to inject malicious URLs and access sensitive server data. The importance of input validation to prevent such threats is emphasized. The post highlights cybersecurity, SSRF, bug bounty, penetration testing, and Nuclei. |
| 2024-09-17 2024 | iototsecnews: MindsDB の脆弱性 CVE-2024-24759 が FIXPoC エクスプロイトも提供 #AIML #DNSRebinding #Exploit #MindsDB #OpenSource #PoCExploit #Sim4n6 #SSRF #Vulnerability news | The content discusses a vulnerability (CVE-2024-24759) in MindsDB, an open-source AI tool. It mentions the availability of a FIXPoC exploit for this vulnerability. The post includes hashtags related to artificial intelligence, machine learning, DNS rebinding, exploit, vulnerability, and SSRF. The vulnerability and exploit details are shared on Twitter by iototsecnews. |
| 2024-09-15 2024 | spencer_5cent: 1/2 For bug bounty I finally moved away from @SynackRedTeam even though I love and respect the platform I just wasn't getting any bugs. So in the past month I've already reported two #SSRF and one #blindxss on @Hacker0x01! news | The content discusses a bug bounty hunter named spencer_5cent who switched from SynackRedTeam to Hacker0x01 due to lack of bugs. In the past month, they reported two Server-Side Request Forgery (#SSRF) and one Blind Cross-Site Scripting (#blindxss) vulnerabilities on Hacker0x01. The tweet expresses gratitude towards SynackRedTeam while highlighting the success on the new platform. |
| 2024-09-13 2024 | e0xsecops: #CocaCola @CocaCola #SSRF news | The content refers to a tweet by e0xsecops about CocaCola and SSRF (Server-Side Request Forgery). The tweet includes hashtags for CocaCola and SSRF, along with a link to the specific tweet on Twitter. It suggests that there may be some relevant information or discussion related to CocaCola and SSRF in the linked tweet. |
| 2024-09-13 2024 | @killmongar1996: New blog: Found multiple SSRF vulnerabilities on a banks system exposing AWS metadata! Learn how I uncovered these flaws and the security risks involved. Check it out! [] #CyberSecurity #AWS #SSRF #EthicalHacking #CloudSecurity intermediate | A new blog post by @killmongar1996 discusses discovering multiple SSRF vulnerabilities in a bank's system, exposing AWS metadata. The post details how these flaws were uncovered and the associated security risks. The content highlights the importance of addressing these vulnerabilities to enhance cybersecurity. The post is shared on Twitter with hashtags like #CyberSecurity, #AWS, #SSRF, #EthicalHacking, and #CloudSecurity. The link to the blog post is provided for those interested in learning more about the findings. |
| 2024-09-12 2024 | @MosharrofMahin: ChatGPT - Server Side Request Forgery (CVE-2024-27564) #ChatGPT #ssrf #CyberSecurity #bug news | The content discusses a Server Side Request Forgery (SSRF) vulnerability in ChatGPT, identified as CVE-2024-27564 by @MosharrofMahin. The post highlights the cybersecurity issue and its potential impact, emphasizing the importance of addressing such vulnerabilities to prevent exploitation. The tweet includes relevant hashtags like #ChatGPT, #ssrf, #CyberSecurity, and #bug, indicating the focus on security concerns and bug reporting. For more details, the original tweet can be found at the provided Twitter link. |
| 2024-09-12 2024 | sudosu01: It might not happen today in a weeks time months or year - but remember each day is a step towards achieving that big win either through #RCE #CSRF #SSRF #SubDomainTakeover #SQL_Injection #WAFbypass -- keep waking up to that website until that big win! #sudo #bug beginner | The content emphasizes the persistence required in cybersecurity, stating that achieving success through vulnerabilities like RCE, CSRF, SSRF, SubDomainTakeover, SQL Injection, and WAFbypass may take time. It encourages daily effort towards the goal and mentions the importance of staying dedicated until the big win is achieved. The use of hashtags like #sudo and #bug highlights the focus on security testing and bug hunting. |
| 2024-09-12 2024 | CWISociety: CWIS President @saranimd is acing the assignment. SSRF: When and how? Well done sir! #cwismember #cwismemberresearch #ssrf beginner | CWIS President @saranimd excels in an assignment on SSRF. The post praises his performance and asks about the timing and method of SSRF. The content is shared on CWISociety's Twitter account, highlighting the president's success and involvement in research. The hashtags #cwismember, #cwismemberresearch, and #ssrf are used to categorize the post. |
| 2024-09-12 2024 | @turkhacksths: Server-Side Request Forgery (SSRF) Nedir ? SSRF sunucuyu kullanarak başka bir sunucuya veya servise (dış ağda ya da iç ağda) istek yapmasına olanak tanır. Bu istekler genellikle HTTP FTP SMB gibi protokollerle yapılır. #SSRF #Hacking #CyberSecurity beginner | The content discusses Server-Side Request Forgery (SSRF), which allows a server to make requests to another server or service, either in an external or internal network. These requests are typically made using protocols like HTTP, FTP, and SMB. The post emphasizes the importance of understanding SSRF for cybersecurity and hacking purposes. |
| 2024-09-11 2024 | @BanCERT_gt: Una vulnerabilidad SSRF (Server-Side Request Forgery) fue descubierta en Microsoft Copilot Studio poniendo en riesgo la seguridad de datos confidenciales y sistemas internos. Fuente: #BanCERT #Ciberseguridad #SSRF #MicrosoftCopilot #Vulnerabilidad news | A Server-Side Request Forgery (SSRF) vulnerability was found in Microsoft Copilot Studio by @BanCERT_gt, posing a risk to confidential data and internal systems. The discovery highlights potential security threats. #BanCERT #Cybersecurity #SSRF #MicrosoftCopilot #Vulnerability |
| 2024-09-10 2024 | @SEIDX57: Day 19 of the 25-day #THM challenge complete! Today I learned about Server-Side Request Forgery (SSRF). This vulnerability allows attackers to trick a server into making unauthorized requests to internal resources. Understanding it is key to preventing data breaches. #SSRF beginner | The content discusses Day 19 of a challenge where the user learned about Server-Side Request Forgery (SSRF), a vulnerability that allows attackers to manipulate servers into making unauthorized requests to internal resources. Understanding SSRF is crucial in preventing data breaches. The user emphasizes the importance of awareness and knowledge about SSRF to enhance cybersecurity. |
| 2024-09-10 2024 | qldfes: #bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #bounty #hacker #vulnerability #ssrf #vdp #security #securityresearch #bughunter #researcher #pentester #pentesting #cybersecurity #VAPT news | The content is a tweet from qldfes including various hashtags related to bug bounty programs, cybersecurity, and vulnerability testing. The tweet likely contains information or updates related to bug bounty tips, hacker communities like HackerOne and Bugcrowd, security research, and penetration testing. The tweet's content can be found by visiting the provided Twitter link. |
| 2024-09-06 2024 | Introducing the URL validation bypass cheat sheet beginner 2 min read | Cheatsheet consolidating known URL validation bypass techniques, addressing vulnerabilities like SSRF, CORS misconfigurations, and open redirection. It helps generate wordlists by leveraging ambiguous URLs to exploit parsing discrepancies and bypass validation, supporting various string encodings and IP address formats including octal, hexadecimal, and binary. The resource also includes payloads that exploit Unicode string normalization and multiline string bypasses against regular expressions, with payloads available on GitHub for community contributions. → portswigger.net |
| 2024-09-06 2024 | DanaEpp: Check out this article to learn how to find and exploit server-side request forgery (SSRF) vulnerabilities in an API. #apihacking #ssrf intermediate | The content shared by DanaEpp discusses how to identify and exploit server-side request forgery (SSRF) vulnerabilities in an API. The article provides insights into the process of finding and exploiting SSRF vulnerabilities, offering valuable information for those interested in API hacking and security. DanaEpp's tweet includes hashtags #apihacking and #ssrf, directing readers to the article for further details on this topic. |
| 2024-09-05 2024 | URL validation bypass cheat sheet - 2024 Edition | Web Security Academy intermediate | This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS ... → portswigger.net |
| 2024-09-04 2024 | edgescan: Are you ready to protect against Server-Side Request Forgery #SSRF attacks? Learn from real-world incidents including the Capital One data breach and discover practical mitigation strategies. Make sure your applications are not susceptible to SSRF beginner | Learn how to defend against Server-Side Request Forgery (SSRF) attacks by understanding real-world incidents like the Capital One data breach. Discover practical mitigation strategies to ensure your applications are not vulnerable to SSRF. Stay informed and protect your systems from potential security threats. |
| 2024-09-04 2024 | apollocourtage: #bugbounty #bugbountytips #bugbountytip #hackerone #bugcrowd #bounty #hacker #vulnerability #ssrf #vdp #security #securityresearch #bughunter #researcher #pentester #pentesting #cybersecurity #VAPT news | The content shared by apollocourtage on Twitter includes hashtags related to bug bounty, cybersecurity, hacker platforms, vulnerabilities, and security research. The post seems to focus on bug bounty tips, hacker platforms like HackerOne and Bugcrowd, various security terms like SSRF and VDP, as well as roles such as bug hunter, researcher, and pentester. The link provided likely leads to more information on these topics. |
| 2024-09-04 2024 | @SandroBruscino: Learn how attackers bypass URL validation in SSRF attacks! PortSwigger's latest cheat sheet reveals key techniques. "Understanding these flaws is critical for defending web apps." #CyberSecurity #SSRF #WebSecurity intermediate | The content discusses how attackers bypass URL validation in SSRF attacks, with PortSwigger's cheat sheet revealing key techniques. Understanding these flaws is crucial for defending web apps. The post emphasizes the importance of cybersecurity, SSRF, and web security. Sandro Bruscino's tweet highlights the significance of recognizing and preventing vulnerabilities in web applications to enhance cybersecurity measures. |