The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2024-09-03 2024 | @onewriteup: Advanced SSRF Security Strategies in 2024 #CyberSecurity #ssrf #BugBounty #ethicalhacking #bugbountytips advanced | The content discusses advanced Server-Side Request Forgery (SSRF) security strategies in 2024, focusing on cybersecurity, bug bounty programs, and ethical hacking. The tweet provides insights and tips related to SSRF vulnerabilities and how to address them effectively. It aims to enhance awareness and understanding of SSRF risks and mitigation techniques within the cybersecurity community. |
| 2024-09-01 2024 | Jeffrey_Mark12: This regex just found me another #0day vulnerability of #SSRF in an open source project /await fetch\(.\$/ #BugBounty #bugbountytips #ethicalhacking #Hacking advanced | Jeffrey_Mark12 discovered a #0day vulnerability related to Server-Side Request Forgery (SSRF) using a regex in an open source project. The regex pattern used was /await fetch\(.*\`$/. This finding was shared on Twitter with hashtags like #BugBounty, #bugbountytips, #ethicalhacking, and #Hacking. The tweet can be found at the link: https://twitter.com/Jeffrey_Mark12/status/1830302403905687855. |
| 2024-09-01 2024 | @zapstiko: Read From SSRF to RFI: Exploiting a Vulnerability to Gain Remote Code Execution by Muhammad Qasim on Medium: #bugbountytips #bugbounty #SSRF #RCE intermediate | The content discusses an article titled "From SSRF to RFI: Exploiting a Vulnerability to Gain Remote Code Execution" by Muhammad Qasim on Medium. It covers insights on exploiting a vulnerability to achieve Remote Code Execution (RCE) through Server-Side Request Forgery (SSRF) and Remote File Inclusion (RFI). The post is related to bug bounty tips and highlights the importance of understanding and mitigating these security risks. The link provided leads to the original article on Medium. |
| 2024-08-31 2024 | @KonwarAbhi98099: Small Bug Tip Most of the injection related vulnerabilities have a unique category called "blind" All are searching for the classic ones. Few hunting for Blind Blind SQLi Blind XSS Blind SSRF #bugbountytips #bugbounty #vulnerability #rxss #xss #sqli #ssrf intermediate | The content discusses a bug tip related to injection vulnerabilities, highlighting the unique category of "blind" vulnerabilities. It mentions that many focus on classic vulnerabilities, while only a few are hunting for blind SQLi, XSS, and SSRF vulnerabilities. The post includes hashtags related to bug bounty tips, vulnerability types, and specific vulnerabilities like XSS, SQLi, and SSRF. The content is shared on Twitter by user @KonwarAbhi98099. |
| 2024-08-31 2024 | Tenable finds critical flaw in Microsofts Copilot Studio news | Tenable discovered a critical flaw in Microsoft's Copilot Studio. The vulnerability poses a significant risk and requires immediate attention. |
| 2024-08-31 2024 | SSRFUtility - SSRF Exploitation Tool intermediate Bug Bounty | A tool to help you exploit SSRF vulnerabilities and get these bounties! |
| 2024-08-30 2024 | @cyb3rshi3ld: Q: In cybersecurity what does a Server-Side Request Forgery (SSRF) attack seek to exploit? A) Misconfigured firewalls B) Weak password policies C) Remote server vulnerabilities D) Validation of server-side requests #cybersecurity #infosec #SSRF #hacking beginner | A Server-Side Request Forgery (SSRF) attack exploits remote server vulnerabilities by manipulating server-side requests. It does not target misconfigured firewalls or weak password policies. This type of attack is a concern in cybersecurity and hacking. |
| 2024-08-29 2024 | @iototsecnews: Microsoft Copilot Studio の脆弱性 CVE-2024-38206深刻な情報漏洩を修正 #AIML #Cloud #Copilot #Microsoft #SSRF #Tenable #Vulnerability news | The content discusses a vulnerability (CVE-2024-38206) in Microsoft Copilot Studio that has been fixed to prevent serious information leakage. The issue was related to SSRF (Server-Side Request Forgery). The post highlights the importance of addressing vulnerabilities promptly to prevent data breaches. The hashtags #AIML, #Cloud, #Copilot, #Microsoft, #SSRF, #Tenable, and #Vulnerability are used to categorize the content. |
| 2024-08-28 2024 | Mind-Maps/SSRF - Hackerscroll at master · imran-parray/Mind-Maps beginner | Mind-Maps of Several Things. Contribute to imran-parray/Mind-Maps development by creating an account on GitHub. |
| 2024-08-27 2024 | DailyDarkWeb: Web Attacks (SSRF) #cybersecurity #infosec #cyberattack #web #ssrf beginner | The content refers to DailyDarkWeb discussing Web Attacks, specifically Server-Side Request Forgery (SSRF). The post is related to cybersecurity, infosec, cyberattacks, and web security, highlighting the importance of protecting against SSRF attacks. The link provided leads to the tweet on Twitter for more information. |
| 2024-08-26 2024 | @davidwillisowen: SSRF in Microsoft Copilot! #ssrf #tenable #copilot #bugbounty news | The tweet by @davidwillisowen highlights a Server-Side Request Forgery (SSRF) vulnerability found in Microsoft Copilot, a tool developed by Microsoft. This vulnerability could potentially be exploited by attackers. The tweet mentions the bug bounty program and includes relevant hashtags like #ssrf, #tenable, #copilot, and #bugbounty. For more details, refer to the original tweet at the provided link. |
| 2024-08-25 2024 | @smugnier: [#Infosec][#Microsoft] L'exploitation de Microsoft #CopilotStudio permet d'accéder à des #données sensibles du #cloud. "Un bug #SSRF dans l'outil de création de #Copilot personnalisée a potentiellement exposé des informations critiques" news | Exploiting Microsoft CopilotStudio allowed access to sensitive cloud data due to a SSRF bug in the custom Copilot creation tool. This vulnerability potentially exposed critical information. The tweet highlights the security issue and its implications. |
| 2024-08-24 2024 | chux13786509: This regex just found me another #0day vulnerability of #SSRF in an open source project /await fetch\(.\$/ #BugBounty #bugbountytips #ethicalhacking #Hacking intermediate | A user named chux13786509 discovered a #0day vulnerability related to Server-Side Request Forgery (#SSRF) in an open source project using a specific regex pattern. The vulnerability was found with the regex /await fetch\(.*\`$/ and was shared on Twitter with hashtags #BugBounty, #bugbountytips, #ethicalhacking, and #Hacking. |
| 2024-08-24 2024 | @CONSEJOSIAC: Un error de SSRF en Microsoft #Copilot Studio permitió a los investigadores acceder a información sensible en la nube. La ciberseguridad nunca fue tan crucial! #Ciberseguridad #SSRF news | A SSRF error in Microsoft #Copilot Studio allowed researchers to access sensitive cloud information, highlighting the critical importance of cybersecurity. #Cybersecurity #SSRF. |
| 2024-08-23 2024 | @Horizon3ai: From @Horizon3Attack: Multiple new #SSRF vulnerabilities leading to NTLMv2 hash disclosure in three of the most popular #Python frameworks out there: Gradio by Hugging Face Jupyter Server and Streamlit from Snowflake. Get all of the details on these CVEs at news | Multiple new SSRF vulnerabilities have been discovered in popular Python frameworks Gradio by Hugging Face, Jupyter Server, and Streamlit from Snowflake, leading to NTLMv2 hash disclosure. Details on these CVEs are available at the provided link. |
| 2024-08-22 2024 | veronicabp_: Rastreada por #Microsoft como CVE-2024-38206 la vulnerabilidad permite a un atacante autenticado eludir la protección #SSRF en Microsoft Copilot Studio para filtrar información sensible basada en la nube news | The tweet by veronicabp_ discusses a vulnerability tracked by Microsoft as CVE-2024-38206. This flaw allows an authenticated attacker to bypass SSRF protection in Microsoft Copilot Studio, enabling them to extract sensitive cloud-based information. The vulnerability poses a risk to the security of the affected software. |
| 2024-08-22 2024 | @killmongar1996: Exciting News: New Blog Post Alert! Im thrilled to announce the release of my latest article Finding SSRF by Full Automation! Dive in here: #SSRF #Automation #InfoSec #Security #BugBounty #PenTesting #EthicalHacking #Vulnerability intermediate | @killmongar1996 announced a new blog post titled "Finding SSRF by Full Automation" focusing on cybersecurity topics like SSRF, automation, InfoSec, bug bounty, pen testing, ethical hacking, and vulnerability. The post aims to provide insights and strategies related to these areas. Interested readers can access the full article through the provided link. |
| 2024-08-22 2024 | lsobiraj: Microsoft Copilot Studio: Datenleck durch SSRF-Schwachstelle möglich #Datenschutz #ITSicherheit #CopilotStudio #CVE202438206 #Microsoft #Sicherheitslücke #SSRF #SSRFSchwachstelle news | Microsoft Copilot Studio is vulnerable to a data leak due to a Server-Side Request Forgery (SSRF) weakness. This poses a risk to data privacy and IT security. The vulnerability is identified as CVE-202438206. The issue highlights a security flaw in Copilot Studio, potentially exposing sensitive information. The tweet by lsobiraj raises awareness about this SSRF vulnerability in Microsoft's Copilot Studio, emphasizing the importance of addressing such security gaps promptly. |
| 2024-08-22 2024 | tarnkappe_info: Microsoft Copilot Studio: Datenleck durch SSRF-Schwachstelle möglich #Datenschutz #ITSicherheit #CopilotStudio #CVE202438206 #Microsoft #Sicherheitslücke #SSRF #SSRFSchwachstelle news | The content discusses a potential data leak in Microsoft Copilot Studio due to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability could lead to unauthorized access to sensitive information. The post highlights the importance of data protection and IT security in addressing this issue. The specific Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is mentioned as CVE-202438206. The tweet from tarnkappe_info provides further details on this security flaw. |
| 2024-08-22 2024 | @FindSecCyber: #Microsoft patched a critical SSRF flaw (CVE-2024-38206) in Copilot Studio protecting sensitive data. Secure your cloud now! How the Exploit Works: #CyberSecurity #CloudSecurity #SSRF #CopilotStudio #Canada #CanadaCyberAwareness news | Microsoft has fixed a critical SSRF vulnerability (CVE-2024-38206) in Copilot Studio to safeguard sensitive data. The post emphasizes securing cloud environments. The exploit details are related to cybersecurity, cloud security, SSRF, Copilot Studio, and Canadian cyber awareness. The tweet encourages taking action to protect cloud systems. |
| 2024-08-22 2024 | manoj29191: Check out my latest article: Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data via @LinkedIn #Cybersecurity #Vulnerability #Microsoft #CVE202438206 #SSRF #InformationDisclosure #MicrosoftCopilot #SecurityFlaw news | The content highlights an article by manoj29191 discussing Microsoft's patching of a critical Copilot Studio vulnerability that exposed sensitive data. The vulnerability, identified by CVE202438206, involved SSRF and information disclosure, posing a security flaw. The article emphasizes cybersecurity concerns and the importance of addressing vulnerabilities promptly. The link provided leads to the original post on Twitter for further details. |
| 2024-08-22 2024 | foxbook: 専門家がMicrosoft Copilot Studioの重大な情報漏洩の欠陥を公表 Experts disclosed a critical information-disclosure flaw in Microsoft Copilot Studio #SecurityAffairs (Aug 21) #セキュリティ脆弱性 #Microsoft #SSRF #情報漏洩 #クラウドセキュリティ news | Experts revealed a serious information-disclosure flaw in Microsoft Copilot Studio, impacting security. The vulnerability was disclosed on August 21, highlighting concerns about security risks related to SSRF and cloud security. The flaw was shared on foxbook's Twitter account, emphasizing the importance of addressing such vulnerabilities promptly to safeguard data and systems. |
| 2024-08-20 2024 | @Cyberwald_talks: #Microsoft #SSRF #CoPilot_Studio SSRFing the Web with the help of Copilot Studio intermediate | The content discusses SSRF (Server-Side Request Forgery) in the context of Microsoft's CoPilot Studio. It highlights how SSRF can be utilized with the assistance of Copilot Studio to manipulate requests sent from a server, potentially leading to security vulnerabilities. The link provided likely offers more details on this topic. |
| 2024-08-18 2024 | akanbi_kunle: Happy Sunday Dive deep into SSRF & LFI vulnerabilities! Utilizing Wayback Machine & Waybackurls to expose secrets. Join forces & let's hunt! #BugBountyHunter #SSRF #LFI #Partner intermediate | The content shared by akanbi_kunle on Twitter encourages diving into SSRF & LFI vulnerabilities using tools like Wayback Machine & Waybackurls to uncover secrets. The post invites collaboration for hunting bugs and mentions relevant hashtags like #BugBountyHunter, #SSRF, #LFI, and #Partner. The focus is on exploring security vulnerabilities and working together to address them. |
| 2024-08-16 2024 | Rajan22m: I completed the Web Security Academy lab: SSRF with blacklist-based input filter @WebSecAcademy #portswigger #websecurity #lab #hacking #ethicalhacker #ethicalhacking #bug #bugbountytips #ssrf #server intermediate | Rajan22m completed the Web Security Academy lab on SSRF with a blacklist-based input filter. The post includes hashtags related to web security, hacking, ethical hacking, bug bounty tips, SSRF, and servers. The completion of this lab likely signifies Rajan22m's progress and expertise in web security and ethical hacking. |
| 2024-08-15 2024 | @Sursanjha: Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to make requests from the server-side potentially leading to unauthorized actions or information disclosure. #SSRF #OWASP #SecurityResearch beginner | The content highlights Server-Side Request Forgery (SSRF) as a web security vulnerability enabling attackers to make requests from the server-side, risking unauthorized actions or information disclosure. The tweet emphasizes the importance of understanding and addressing SSRF to enhance web security. It references OWASP and Security Research as relevant areas for further exploration. |
| 2024-08-15 2024 | @AbhijeetKumaw10: Day 12: Mastering Server SIde Request Forgery Vulnerability Uncover hidden SSRF Vulnerability flaws with advanced payloads and Defense bypass techniques. Check out the full blog here: #BugBounty #WebSecurity #30daychallenge #ssrf intermediate | The content discusses mastering Server-Side Request Forgery (SSRF) vulnerability, revealing hidden flaws using advanced payloads and defense bypass techniques. The author shares insights in a blog post as part of a 30-day challenge, focusing on Bug Bounty, Web Security, and SSRF. The tweet provides a link to the full blog post for further details. |
| 2024-08-14 2024 | Critical SAP Auth Bypass and SSRF Flaws Fixed Update Now news | Critical authentication bypass and Server-Side Request Forgery (SSRF) vulnerabilities in SAP have been addressed. Users are advised to update their systems immediately to mitigate the risks associated with these flaws. It is crucial to apply the fixes promptly to prevent potential exploitation by malicious actors. |
| 2024-08-14 2024 | basu_banakar: Thread On: Testing for Blind/Non-Blind SSRFs using redirection in integrations where there are some filters. #bugbountytips #BugBounty #ssrf #bugbountytips 1. Hit the integration by using burp collaborator by using random credentials. intermediate | The content discusses testing for Blind/Non-Blind SSRFs using redirection in integrations with filters. The suggestion is to test by hitting the integration with Burp collaborator using random credentials. The post is shared on Twitter by basu_banakar. The focus is on bug bounty tips related to SSRF vulnerabilities. |
| 2024-08-14 2024 | it4chis3c: Day 12: Mastering Server SIde Request Forgery Vulnerability Uncover hidden SSRF Vulnerability flaws with advanced payloads and Defense bypass techniques. Check out the full blog here: #BugBounty #WebSecurity #30daychallenge #ssrf intermediate | The content discusses mastering Server-Side Request Forgery (SSRF) vulnerability, revealing hidden flaws using advanced payloads and defense bypass techniques. The blog provides insights into uncovering SSRF vulnerabilities. It is part of a 30-day challenge on Bug Bounty and Web Security. The full blog can be accessed through the provided link. |
| 2024-08-14 2024 | Checkmarx: #CVE-2024-39338: Axios critical vulnerability alert! Versions 1.3.2 up to 1.7.3 allow Server-Side Request Forgery via URL manipulation. SSRF could lead to internal system access or data exfiltration. #SSRF #AppSec news | The content warns about a critical vulnerability in Axios versions 1.3.2 to 1.7.3, allowing Server-Side Request Forgery (SSRF) through URL manipulation. This SSRF exploit could result in unauthorized access to internal systems or data theft. Checkmarx issued a CVE alert for this vulnerability, emphasizing the importance of addressing it promptly to prevent potential security breaches. #SSRF #AppSec. |
| 2024-08-09 2024 | @lu3ky13: learn everything about SSRF OPEN REDIRECT and #Subdomain #Takeover Server-Side Request Forgery (#SSRF) What is a Subdomain Takeover? What is open redirects Insecure Direct Object References (#IDOR) #bugbountytip #BugBounty beginner | The content discusses Server-Side Request Forgery (SSRF), Open Redirect, Subdomain Takeover, and Insecure Direct Object References (IDOR) in the context of bug bounty programs. It provides information on what SSRF, Subdomain Takeover, and Open Redirect vulnerabilities are, along with tips for bug bounty hunters. The content is shared on Twitter by the user @lu3ky13. |
| 2024-08-09 2024 | @nader_brandi: SSRF Techniques: Scenarios #SSRF #ServerSideRequestForgery #WebSecurity #AdvancedHacking #EthicalHacking #CyberSecurity #VulnerabilityResearch #SecurityTesting #AppSec #PenTesting #ExploitDev #NetworkSecurity #InfoSec #BugBountyTips #VulnDiscovery #BugBounty intermediate | The content shared by @nader_brandi on Twitter discusses SSRF (Server-Side Request Forgery) techniques through various scenarios. The post covers topics related to web security, ethical hacking, cyber security, vulnerability research, security testing, application security, penetration testing, exploit development, network security, information security, bug bounty tips, vulnerability discovery, and bug bounty programs. The tweet provides a link for further details. |
| 2024-08-06 2024 | @thezigzag3: #Bitdefender #Vulnerability #Let #Attackers #Trigger #SSRF #attacks news | The tweet by @thezigzag3 highlights a vulnerability in Bitdefender that allows attackers to trigger Server-Side Request Forgery (SSRF) attacks. This vulnerability could potentially be exploited by malicious actors to manipulate server requests and access sensitive information. It is crucial for users of Bitdefender to be aware of this issue and take necessary precautions to protect their systems from such attacks. |
| 2024-08-05 2024 | @coderadipv: Just published a new blog on Medium about Server-Side Request Forgery (SSRF) vulnerabilities! Dive in to learn how SSRF works and ways to protect against it. Check it out! #CyberSecurity #SSRF #Medium #infosecurity #blogging beginner | @coderadipv shared a new blog on Medium about Server-Side Request Forgery (SSRF) vulnerabilities. The post explains how SSRF works and offers tips on protecting against it. The focus is on cybersecurity, SSRF, and information security. The tweet includes a link to the Medium blog post for those interested in learning more. |
| 2024-08-05 2024 | @coderadipv: Just completed the SSRF room on @RealTryHackMe ! Learning about Server-Side Request Forgery was super insightful. #cybersecurity #TryHackMe #SSRF #learning #infosec beginner | @coderadipv completed the SSRF room on @RealTryHackMe, finding Server-Side Request Forgery insights valuable for cybersecurity. The tweet highlights learning experiences in the cybersecurity field. #SSRF #cybersecurity #TryHackMe #infosec |
| 2024-08-02 2024 | SSRF: A complete guide to exploiting advanced SSRF vulnerabilities beginner 8 min read | Guide detailing Server-Side Request Forgery (SSRF) vulnerabilities, covering identification techniques for features like profile image loaders and webhook services. It explains exploiting basic SSRFs, bypassing host and protocol whitelists with methods like DNS rebinding and redirect chains, and leveraging SSRFs within PDF generators. The guide also touches upon second-order SSRFs and mentions using `PayloadsAllTheThings` for advanced bypasses. |
| 2023-12-20 2023 | XSSRF : The Matrimony of XSS and SSRF. intermediate XSS | The content discusses the concept of XSSRF, which is a combination of Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF). This fusion poses a significant security threat as it allows attackers to manipulate client-side scripts to make unauthorized requests to the server. By exploiting vulnerabilities in web applications, attackers can bypass security measures and potentially gain access to sensitive information or perform malicious actions. It is crucial for developers to be aware of XSSRF attacks and implement proper security measures to prevent such exploits. |
| 2023-11-14 2023 | Breaking Down SSRF on PDF Generation: A Pentesting Guide intermediate | The content discusses SSRF (Server-Side Request Forgery) vulnerabilities in PDF generation, providing a pentesting guide. It likely delves into how SSRF can be exploited during PDF creation processes, highlighting potential security risks and offering insights on how to test for and mitigate these vulnerabilities. The guide may include techniques for identifying and exploiting SSRF issues, as well as recommendations for securing PDF generation processes against such attacks. Overall, it aims to educate readers on the importance of addressing SSRF vulnerabilities in PDF generation to enhance cybersecurity measures. |
| 2023-11-07 2023 | 11.2 Lab: Exploiting XXE to perform SSRF attacks | 2023 intermediate | The content discusses a lab session focused on exploiting XML External Entity (XXE) vulnerabilities to conduct Server-Side Request Forgery (SSRF) attacks. This practical exercise likely involves demonstrating how attackers can manipulate XML input to access internal resources and potentially launch SSRF attacks. The lab aims to provide hands-on experience in understanding and mitigating these security risks. Participants will likely gain insights into the exploitation of XXE vulnerabilities and the associated SSRF attack vectors. The session may offer valuable insights into securing applications against such threats. → cyberw1ng.medium.com |
| 2023-11-01 2023 | What are SSRF Attacks and How They Work to Disrupting Email Security beginner 6 min read | Analysis of Server-Side Request Forgery (SSRF) attacks, a significant threat listed in the OWASP Top 10 (A10:2021), details how attackers forge server requests to access internal resources, potentially stealing data or deploying malware. The attack vector often targets unpatched vulnerabilities in applications that fetch remote resources without proper URL validation, exploiting variants like special character injection, localhost queries, and various URL schemas. Specific threats include exploits targeting Java RMI Services and VMware Workspace ONE Access (CVE-2021-22056). Mitigation strategies involve whitelisting/blacklisting, response verification, discarding unused URL schemas, and enabling internal service authentication. |
| 2023-11-01 2023 | Latest server-side request forgery (SSRF) news news | Library from PortSwigger, the makers of Burp Suite, offering a comprehensive toolkit for web security testing. This resource highlights the evolution of server-side request forgery (SSRF) and showcases how Burp Suite, trusted by industry leaders like Microsoft and a thriving community of practitioners, remains the benchmark for discovering and mitigating web vulnerabilities. → portswigger.net |
| 2023-10-07 2023 | Exploiting Non-Cloud SSRF for More Fun & Profit advanced | The content discusses exploiting Server-Side Request Forgery (SSRF) vulnerabilities outside of cloud environments for increased enjoyment and financial gain. It likely delves into techniques, strategies, and potential risks associated with leveraging SSRF vulnerabilities in non-cloud settings. The focus seems to be on exploring the possibilities and implications of SSRF exploitation beyond traditional cloud platforms. |
| 2023-04-01 2023 | Fun with SSRF - Turning the Kubernetes API Server into a port scanner intermediate 3 min read | Library for port scanning via Kubernetes API Server Server-Side Request Forgery (SSRF). This technique leverages standard Kubernetes functionality, specifically Validating Admission Webhooks, to make the API server initiate network requests. By creating a webhook configured to target a specific host and port, and then attempting to create a resource that triggers the webhook, attackers can interpret the API server's verbose error messages to infer port status (open, closed, or unreachable) from the perspective of the Kubernetes API server. A proof-of-concept tool is provided to automate this process. |
| 2023-03-29 2023 | Server Side Request Forgery | Mastering Modern Web Penetration Testing beginner | https://ift.tt/nYHI9mN |
| 2023-02-24 2023 | Ssrf beginner | The content provided is a link to a webpage related to SSRF (Server-Side Request Forgery), a type of web vulnerability where an attacker can manipulate a web application to make unauthorized requests on behalf of the server. SSRF can be exploited to access internal systems, perform port scanning, or launch attacks on other servers. It is crucial for developers to be aware of SSRF risks and implement security measures to prevent such attacks. |
| 2023-02-17 2023 | SSRF That Allowed Us to Access Whole Infra Web Services and Many More intermediate 3 min read | Writeup detailing a successful SSRF vulnerability exploitation on a large user-base application. The author leveraged Burp Collaborator and AWS metadata URL (169.254.169.254), bypassing Cloudflare WAF by converting the IP to its decimal representation (2852039166). This allowed access to sensitive user data and IAM credentials, enabling reconnaissance of internal AWS EC2 instances and subsequently brute-forcing over 200 internal web services. |
| 2023-02-14 2023 | Server-Side Request Forgery (SSRF) Attacks: The Ultimate Guide beginner 9 min read | Guide to understanding and preventing Server-Side Request Forgery (SSRF) attacks, which can compromise sensitive data by tricking servers into making unauthorized requests. This resource details how SSRF works, its various risks including data leakage, port scanning, denial of service, and remote code execution, and distinguishes it from CSRF. It also covers two types of SSRF: non-blind, where attackers exploit visible server responses, and blind SSRF, used for unauthorized actions on the back end. |
| 2023-02-14 2023 | How To: Server-Side Request Forgery (SSRF) beginner 9 min read | Guide to Server-Side Request Forgery (SSRF) vulnerabilities, detailing how attackers can control server-initiated requests. The entry explains the impact of SSRF, testing methodologies using tools like netcat, and techniques to bypass common mitigations such as IP blacklisting and whitelisting, including exploiting HTTP redirects and DNS records. It highlights common attack vectors like webhooks and PDF generators. → hackerone.com |
| 2023-02-14 2023 | Beginner Guide To Exploit Server Side Request Forgery (SSRF) Vulnerability beginner | The content is a beginner's guide on exploiting Server Side Request Forgery (SSRF) vulnerabilities. SSRF is a type of security vulnerability that allows an attacker to make requests on behalf of the server. The guide likely covers the basics of SSRF, how to identify and exploit these vulnerabilities, and potentially includes tips on prevention and mitigation strategies. It aims to educate readers on understanding and exploiting SSRF vulnerabilities for security testing and awareness purposes. |