A somewhat curated list of links to information about Server Side Request Forgery (SSRF).
| Link | Excerpt |
|---|---|
| https://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf | |
| https://medium.com/@D0rkerDevil/how-i-convert-ssrf-to-xss-in-a-ssrf-vulnerable-jira-e9f37ad5b158?source=userActivityShare-90814179aa21-1529090798 | |
| https://medium.com/@rootxharsh_90844/vimeo-ssrf-with-code-execution-potential-68c774ba7c1e | |
| https://medium.com/@armaanpathan/pdfreacter-ssrf-to-root-level-local-file-read-which-led-to-rce-eb460ffb3129 | |
| https://link.medium.com/HOGdT5ocfW | |
| https://link.medium.com/JzxK9eodaX | |
| https://medium.com/@vickieli/bypassing-ssrf-protection-e111ae70727b | |
| https://link.medium.com/oa2D2LupcZ | |
| https://link.medium.com/eYV17swFvZ | |
| https://link.medium.com/VoengTvAi1 | |
| https://link.medium.com/j3rkNajmr5 | |
| https://cheatsheetseries.owasp.org/assets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet_SSRF_Bible.pdf | |
| https://medium.com/bugbountywriteup/story-of-a-2-5k-bounty-ssrf-on-zimbra-led-to-dump-all-credentials-in-clear-text-6fe826005ccc | |
| https://medium.com/bugbountywriteup/vimeo-ssrf-with-code-execution-potential-68c774ba7c1e | |
| https://medium.com/bugbountywriteup/my-first-bug-blind-ssrf-through-profile-picture-upload-72f00fd27bc6 | |
| https://medium.com/bugbountywriteup/server-side-request-forgery-ssrf-f62235a2c151 | |
| https://link.medium.com/3LqSxFV4j9 | |
| https://medium.com/bugbountywriteup/server-side-request-forgery-ssrf-exploitation-technique-9bc4b4045fbd | |
| https://medium.com/@shahjerry33/blind-ssrf-the-hide-seek-game-da9d0ecef2fb | |
| https://infosecwriteups.com/story-of-a-really-cool-ssrf-bug-cf88a3800efc | |
| https://medium.com/@logicbomb/the-journey-of-web-cache-firewall-bypass-to-ssrf-to-aws-credentials-compromise-b250fb40af82 | |
| https://infosecwriteups.com/walkthrough-weather-app-hack-the-box-web-challenge-34b0c930dfca | |
| https://medium.com/@tobydavenn/the-tale-of-ssrf-to-rce-on-gov-domain-191185b32b37 | |
| https://medium.com/@dphoeniixx/vimeo-upload-function-ssrf-7466d8630437 | |
| https://medium.com/@vickieli/intro-to-ssrf-beb35857771f | |
| https://medium.com/@notifybugme/finding-ssrf-by-full-automation-7d2680091d68 | |
| https://medium.com/@notifybugme/how-github-recon-help-me-to-find-nine-full-ssrf-vulnerability-with-aws-metadata-access-531d931413a5 | |
| https://medium.com/bugbountywriteup/story-of-a-really-cool-ssrf-bug-cf88a3800efc | |
| https://medium.com/@notifybugme/escalating-ssrf-to-accessing-all-user-pii-information-by-aws-metadata-aabcfd5a3e0e | |
| https://medium.com/@notifybugme/aws-internal-metadata-accessed-through-ssrf-by-chaining-an-open-redirect-bug-c4b0e4838dc | |
| https://medium.com/@corneacristian/top-25-server-side-request-forgery-ssrf-bug-bounty-reports-136928356eca | |
| https://medium.com/bugbountywriteup/600k-bounty-jetty-features-response-queue-poisoning-bypass-ssrf-protections-xss-9b7644077829 | |
| https://medium.com/@michaelkoczwara/server-side-request-forgery-ssrf-portswigger-labs-98469a41b720 | |
| https://medium.com/@shahjerry33/hey-man-if-i-talk-about-the-impact-it-is-comparatively-low-than-that-of-normal-ssrf-because-of-its-cd46a085740a | |
| https://hacktricks.boitatech.com.br/pentesting-web/ssrf-server-side-request-forgery | |
| https://www.softwaresecured.com/introduction-to-server-side-request-forgery/ | |
| https://hacklido.com/blog/294-ssrf-that-allowed-us-to-access-whole-infra-web-services-and-many-more | |
| https://link.medium.com/dmLthOOGmyb | |
| https://karol-mazurek95.medium.com/appsec-tales-xvii-ssrf-35e3a08c278 | |
| A10 Server Side Request Forgery (SSRF) | This category is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage and above-average Exploit and Impact potential ratings. |
| x.com | |
| Testing for SSRF with Burp Suite | Server-side request forgery (SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. |
| x.com | |
| Azure SSRF Metadata | Azure provides a metadata service that allows applications on a Virtual Machine (VM) to access information about the machine’s configuration, including any associated service account credentials. The sensitivity of this information makes it a common target for adversaries. |
| Server Side Request Forgery (SSRF) Attacks & How to Prevent Them | Server-Side Request Forgery (SSRF) attacks allow an attacker to make requests to any domains through a vulnerable server. Attackers achieve this by making the server connect back to itself, to an internal service or resource, or to its own cloud provider. |
| How Orca Found Server-Side Request Forgery (SSRF) Vulnerabilities in Four Different Azure Services | As part of the Orca Research Pod efforts, we regularly research various cloud provider services and capabilities to help our customers keep their assets safe and secure in the cloud. |
| qazbnm456/awesome-web-security | Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of engineers' security skills, etc. |
| CWE-918 | Content History Submissions Submission Date Submitter Organization 2013-02-17 (CWE 2. |
| Detect SSRF attacks in cloud applications and APIs | APIs can be vulnerable to a wide variety of attacks, such as poor inventory management and access controls, making them a primary target for attackers. Server-side request forgery (SSRF) is one type of attack that has become more prominent with the rising use of public clouds. |
| Server-side request forgery (SSRF) | For Snyk Enterprise customers with regional contracts. More info Server-side request forgery (SSRF) is a type of attack that allows an adversary to make arbitrary outbound requests from a server. |
| SSRFing the Web with the help of Copilot Studio | Tenable Research discovered a critical information-disclosure vulnerability in Microsoft’s Copilot Studio via a server-side request forgery (SSRF), which allowed researchers access to potentially sensitive information regarding service internals with potential cross-tenant impact. |
| What is Server-Side Request Forgery? | Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can trick a server into making unintended requests to internal or external resources. These requests are made from the server itself, which can have more privileges and access compared to a client-side request. |
| How to Prevent Server-Side Request Forgery | In today's digital age, protecting your organization's web applications from security threats is of paramount importance. Server-side request forgery (SSRF) attacks are one such threat that can compromise your systems and expose sensitive data. |
| Server-side request forgery (SSRF) | What is SSRF? Server-side request forgery (SSRF) is a vulnerability that lets a malicious hacker send a request from the back end of the software to another server or to a local service. |
| SSRF in real life | At Alan, we are continuously improving our product to delight our members. One downside is that increasing our codebase size exposes us to security issues and vulnerabilities. Let me tell you about a story that happened recently. |
| SSRF bible. Cheatsheet | |
| taviso/rbndr | rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl. |
| How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! | Hi, it’s been a long time since my last blog post. In the past few months, I spent lots of time preparing for the talk of Black Hat USA 2017 and DEF CON 25. Being a Black Hat and DEFCON speaker is part of my life goal ever. This is also my first English talk in such formal conferences. |
| PHP SSRF Techniques | In this article, I want to go deep on a few SSRF techniques that you can use against a PHP script that use filters like filter_var() or preg_match() and get HTTP contents using curl or file or file_get_contents(). |
| AWS takeover through SSRF in JavaScript | Here is the story of a bug I found in a private bug bounty program on Hackerone. It took me exactly 12h30 -no break- to find it, exploit and report. |
| B-XSSRF - Toolkit To Detect And Keep Track On Blind XSS, XXE And SSRF | Toolkit to detect and keep track on Blind XSS, XXE & SSRF. |
| A Pentester’s Guide to Server Side Request Forgery (SSRF) | What is SSRF? In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL, which the code running on the server will read or submit data. |
| SSRF and Open Redirect CheatSheet | SSRF Basic ?url=http://localhost/server-status ?url=http://127.0.0.1/server-status ?url=http://internal_domain/page ?url=http://internal_ip(192.138.0.14)/page Bypass SSRF with Special chars ?url=http://allow_domain. |
| 10 Types of Web Vulnerabilities that are Often Missed | Crowdsource hackers Hakluke and Farah Hawa share the top web vulnerabilities that are often missed during security testing. When hunting for bugs, especially on competitive bug bounty programs, it is always best to hunt in a way that invokes the least competition. |
| Server-Side Request Forgery (SSRF) | In this chapter, we are going to learn about server-side request forgery (or also called SSRF). TL;DR: An SSRF vulnerability allows an attacker to send requests from an asset behind the firewall. |
| reddelexc/hackerone-reports | Tops of HackerOne reports. All reports' raw info stored in data.csv. Scripts to update this file are written in Python 3 and require chromedriver and Chromium executables at PATH. Every script contains some info about how it works. The run order of scripts: Tops 100. |
| An overlooked parameter leads to a critical SSRF in Dropbox bug bounty program | Check out Intigriti: https://www.intigriti.com/ 📧 Subscribe to BBRE Premium: https://bbre.dev/premium ($20 OFF with code BIRTHDAY) ✉️ Sign up for the mailing list: https://bbre.dev/nl 📣 Follow me on Twitter: https://bbre.dev/tw This video is an explanation of an SSRF found by Harsh Jaisw |
| README.md | Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today: A Server-side Request Forgery (SSRF) vulnerability occurs when an attacker manipulates a server-side application into making HTTP requests to a domain of their choice. |
| QA Platform | |
| ssrf.md | {% hint style="info" %} Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. |
| ssrf-parameters.txt | For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙 - top25-parameter/ssrf-parameters.txt at master · lutfumertceylan/top25-parameter |
| blackhatethicalhacking/SSRFPwned | SSRFPwned is written by Chris "SaintDruG" Abou-Chabké from Black Hat Ethical Hacking and is designed for Offensive Security attacks. |
| Exfiltrated, Signed, Delivered – What Can Go Wrong When an Amazon Elastic Compute Cloud (EC2) Instance is Exposed to SSRF | Using CNAPPgoat, you can now experiment with a technique that leverages exposure to SSRF to trigger calls to AWS services from within an Amazon EC2 instance. CNAPPgoat is Tenable Cloud Security’s open-source contribution to the multi-cloud environment landscape. |
| Find and Exploit Server-Side Request Forgery (SSRF) Using Burp Suite | Bug Bounty Live | ❗| THIS VIDEO IS ONLY FOR EDUCATIONAL PURPOSE ------------------------------------------------ The Regex to Use: (https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\ |
| Exploit Server-Side Request Forgery (SSRF). | #exploitssrf #ssrf #exploit Exploit Server-Side Request Forgery SSRF | Find and Exploit Server-Side Request Forgery SSRF. What is SSRF (Server-side request forgery)? Tutorial ... Learn what server-side request forgery (SSRF) is, how it works, and how to exploit it. Find out the impact of SSRF at |
| XSSRF : The Matrimony of XSS and SSRF. | Hey folks, Nauman Khan back in action! 🚀 Today, we’re diving into the depth of XSSRF — where Server-Side Request Forgery (SSRF) meets Cross-Site Scripting (XSS). Lets Learn How I was able to turn an Informative(P5) SSRF to an High(P2) Severity Vulnerability And Got $$$ for it. |
| Hunting for SSRF Bugs in PDF Generators | If you’ve been on a website and noticed one of the following features, there’s a good chance you’ve stumbled upon a hot spot for server-side request forgery (SSRF) bugs: Print a certificate of completion Generate a report Submit a digital signature Before getting into the nuts ‘n’ bolts of |
| Owning the clout through SSRF and PDF generators - Public v1.0 | In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. |
| Digging for SSRF in NextJS apps | If you want to design a mostly static, modern landing page for your brand new business, what do you do? Ten years ago, it felt like every company was using a heavyweight CMS like Wordpress. As a hacker, the attack surface of CMS solutions is well understood. |
| Find SSRF , LFI , XSS using httpx , waybackurls , gf , gau , qsreplace | This will help you in bug bounty because it’s advance bug bounty tips i have also a please visit there and watch video on advance subdomain recon and subdomain takeover and some poc video is also there. So let’s start |
| SSRF EXPLOITATION: FILE DISCLOSURE | 2023 | BUG BOUNTY | Note: This video is only for educational purpose. Intigriti: https://go.intigriti.com/bepractical Hi everyone! In this video, you will learn how to exploit server side request forgery to file disclosure vulnerability Website: https://bepractical.tech Telegram: https://telegram.me/bepracticaltech |
| Penetration Testing for Server-Side Request Forgery (SSRF) in E-commerce Platforms | E-commerce platforms are highly vulnerable to various security threats, and one of the most critical vulnerabilities is Server-Side Request Forgery (SSRF). |
| Breaking Down SSRF on PDF Generation: A Pentesting Guide | So today’s article is about the approach for hunting SSRF, I will be more focused on the PDF generation side. Let’s dive into it! Server side request vulnerability occurs when an attacker can manipulate the input to a web application that triggers a request from the server to a remote resource. |
| assetnote/surf | surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering them into a list of externally facing and internally facing hosts. |
| Introduction | Introduction What is Server Side Request Forgery (SSRF)? Server Side Request Forgery occurs when you can coerce a server to make arbitrary requests on your behalf. |
| Security Bugs in Practice: SSRF via Request Splitting | One of the most interesting (and sometimes scary!) parts of my job at Mozilla is dealing with security bugs. |
| Server-Side Request Forgery (SSRF) vulnerable Lab | This repository contain PHP codes which are vulnerable to Server-Side Request Forgery (SSRF) attack. In programming languages, there are functions which can fetch the contents of locally saved file. These functions may be capable of fetching the content from remote URLs as well local files (e. |
| SSRF Cross Protocol Redirect Bypass · Doyensec's Blog | Server Side Request Forgery (SSRF) is a fairly known vulnerability with established prevention methods. So imagine my surprise when I bypassed an SSRF mitigation during a routine retest. |
| Securing PDF Generators Against SSRF Vulnerabilities | A couple of months ago, I was trying to figure out how I could secure a PDF generator running in AWS Lambda against SSRF attacks. SSRF attacks are a type of attack where an attacker can trick a service into making requests to arbitrary external resources. |
| Mitigating SSRF in 2023 | Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to trick a server-side application to make a request to an unintended location. SSRF, unlike most other specific vulnerabilities, has gained its own spot on the OWASP Top 10 2021. |
| Blind SSRF - The Tray | Hi fellow hunters, in this write-up, I will explain how I found a Blind SSRF and got a red bull tray as a reward. The Redbull Bug Bounty program is on Intigriti’s Platform. Blind SSRF is a type of SSRF attack where the attacker cannot see the response from the server. |
| Attacking APIs with SSRF and how to prevent it | Based on the 2023 OWASP API Security Top 10 this is one of the common attack types. The exploitability and detectability are easy making it quite dangerous. Server-Side Request Forgery (SSRF) flaws occur when an API is fetching a remote resource without validating the user-supplied URL. |
| Server-side request forgery (SSRF) in Web App Penetration Testing | 2023 | Server-side request forgery is a web security vulnerability that allows an attacker to cause the server-side application to make requests to an unintended location. |
| “The future of SSRF attacks” Machine learning and AI-based exploitation | As the world becomes increasingly digital, cybersecurity threats are evolving at an unprecedented pace. One of the vulnerabilities that has been on the rise is Server-Side Request Forgery (SSRF), and its future holds both potential for defenders and challenges for security professionals. |
| 11.2 Lab: Exploiting XXE to perform SSRF attacks | 2023 | This lab has a “Check stock” feature that parses XML input and returns any unexpected values in the response. The lab server is running a (simulated) EC2 metadata endpoint at the default URL, which is http://169.254.169.254/. |
| “SSRF to RCE” A case study in exploiting chained vulnerabilities | Server-Side Request Forgery (SSRF) vulnerabilities are known to be serious, allowing attackers to manipulate requests from a web application. |
| “Bypassing SSRF protection measures” Techniques for evading WAFs and input validation | Server-Side Request Forgery (SSRF) vulnerabilities are a persistent threat to web applications and cloud services. To exploit SSRF, attackers often need to bypass security measures such as Web Application Firewalls (WAFs) and input validation checks. |
| “SSRF hunting in the cloud” Exploiting misconfigured services in cloud environments | Server-Side Request Forgery (SSRF) vulnerabilities have become increasingly prevalent in cloud environments due to the growing adoption of cloud services and the complexities they introduce. These vulnerabilities often stem from misconfigured services and can have devastating consequences. |
| Exploring the SSRF attack surface | Server-Side Request Forgery (SSRF) is a critical security vulnerability that often goes unnoticed, leaving web applications and cloud services exposed to potential attacks. Understanding the SSRF attack surface is the first step in mitigating this threat effectively. |
| What is SSRF? (Portswigger – Lab: Basic SSRF against the local server) | Hello Cyberman! This article subject SSRF attacks. This series of articles will be with Portswigger solutions. |
| SSRF vulnerabilities and where to find them | It’s no secret that cloud architectures have several characteristics that make SSRF attacks challenging to defend against. While SSRFs are not a new threat vector, they are often misunderstood and confused with CSRFs. |
| SSRF Sheriff | This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Released under the MIT License. |
| SSRF Proxy | SSRF Proxy SSRF Proxy is a multi-threaded HTTP proxy server designed to tunnel client HTTP traffic through HTTP servers vulnerable to Server-Side Request Forgery (SSRF). Once configured, SSRF Proxy attempts to format client HTTP requests appropriately for the vulnerable server. |
| NucleiFuzzer - Powerful Automation Tool For Detecting XSS, SQLi, SSRF, Open-Redirect, Etc.. Vulnerabilities In Web Applications | NucleiFuzzer is an automation tool that combines ParamSpider and Nuclei to enhance web application security testing. It uses ParamSpider to identify potential entry points and Nuclei's templates to scan for vulnerabilities. |
| SSRF Bypass List | Base-Url: 127.0.0.1 Client-IP: 127.0.0.1 Http-Url: 127.0.0.1 Proxy-Host: 127.0.0.1 Proxy-Url: 127.0.0.1 Real-Ip: 127.0.0.1 Redirect: 127.0.0.1 Referer: 127.0.0.1 Referrer: 127.0.0.1 Refferer: 127.0.0.1 Request-Uri: 127.0.0.1 Uri: 127.0.0.1 Url: 127.0.0.1 X-Client-IP: 127.0.0. |
| My First Case of SSRF Using Dirsearch | Hello, I am a 16-year-old bug bounty hunter. I would like to appreciate God Almighty for helping me to find this bug. |
| Exploiting Non-Cloud SSRF for More Fun & Profit | Let's jump in directly, while hunting on some random target in my spare time, I came across one subdomain where we can see the reports related to the company and marketing, I found one functionality where we can see the report in pdf format. |
| SSRF attacks explained and how to defend against them | However, files and assets that are directly accessible to the general audience surfing the web might be accessible by the server itself. For example, as a visitor, you can easily request a public URL like https://www.csoonline. |
| What are SSRF Attacks and How They Work to Disrupting Email Security | SSRF attacks have gained momentum in recent years. They have been used as a break-in technique in significant attacks on organizations like Capital One and Microsoft. |
| 0xdf hacks stuff | Much like CrossFit, CrossFitTwo was just a monster of a box. The centerpiece is a crazy cross-site scripting attack through a password reset interface using DNS to redirect the admin to a site I control to then have them register an account for me. I’ll then hijack some socket. |
| SSRFIRE | An automated SSRF finder. Just give the domain name and your server and chill! ;) It also has options to find XSS and open redirects. If you don't have burpsuite professional, you can use interact sh by the awesome projectdiscovery team as your server. |
| Th0h0/autossrf | Summary autoSSRF is your best ally for identifying SSRF vulnerabilities at scale. |
| SSRFmap | SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz. |
| ssrf | Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing. |
| Server-Side Request Forgery Attack Explained: Definition, Types, Protection | A Server-Side Request Forgery attack (SSRF) is a security vulnerability in which a hacker tricks a server into accessing unintended resources on his behalf. An SSRF attack can lead to sensitive information being leaked or the attacker gaining control of other systems. |
| Oh snap! We don't support this version of your browser, and neither should you! | You are visiting this page because we detected an unsupported browser. Your browser does not support security features that we require. We highly recommend that you update your browser. If you believe you have arrived here in error, please contact us. Be sure to include your browser version. |
| Exfiltrated, Signed, Delivered – What Can Go Wrong When an Amazon Elastic Compute Cloud (EC2) Instance is Exposed to SSRF | TL; DR: Using CNAPPgoat, you can now experiment with a technique that leverages exposure to SSRF to trigger calls to AWS services from within an Amazon EC2 instance. Check it out! CNAPPgoat is Ermetic’s open-source contribution to the multicloud environment landscape. |
| Cloud SSRF | HackTricks HackTricks CloudTwitchYoutubeTwitter Search ⌃K Links 👾 Welcome! HackTricks About the author Getting Started in Hacking 🤩 Generic Methodologies & Resources Pentesting Methodology External Recon Methodology Pentesting Network Pentesting Wifi Phishing Methodology Basic Forensic Met |
| SSRF (Server Side Request Forgery) | HackTricks Search… ⌃K HackTricks Search… ⌃K 👾 Welcome! HackTricks About the author Getting Started in Hacking 🤩 Generic Methodologies & Resources Pentesting Methodology External Recon Methodology Pentesting Network Pentesting Wifi Phishing Methodology Basic Forensic Methodology Brute |
| On SSRF (Server Side Request Forgery) or Simple Stuff Rodolfo Found | I think the most we have to test against an application the better. But as you can see by yourself (correct me if I’m wrong please) the following set of scenarios and payloads are not addressed in most of the lists you can find out there for SSRF (Server Side Request Forgery). |
| Awesome Bug Bounty Tools | Awesome Bug Bounty Tools A curated list of various bug bounty tools Contents Recon Subdomain Enumeration Port Scanning Screenshots Technologies Content Discovery Links Parameters Fuzzing Exploitation Command Injection CORS Misconfiguration CRLF Injection CSRF Injection Directory Traversal File Inc |
| SSRF vulnerabilities and where to find them | Server-Side Request Forgery (SSRF) occurs when an application accepts a URL (or partial URL) from the user, then accesses that URL from the server. It’s important to note that SSRF is only a vulnerability if there is some security impact. |
| devanshbatham/Vulnerabilities-Unmasked | This repo tries to explain complex security vulnerabilities in simple terms that even a five-year-old can understand! Imagine you have a toy box where you and your friends can put your favorite toys in and take them out whenever you want. Each of you can only take out your own toys. |
| SSRF Cheat Sheet & Bypass Techniques ∞ | What is SSRF? Server Side Request Forgery (SSRF) is a web vulnerability that allows an attacker to exploit vulnerable functionality to access server side or local network services / functionality by affectively traversing the external firewall using vulnerable web functionality. |
| Defender's Notes | |
| Server Side Request Forgery Prevention | The objective of the cheat sheet is to provide advices regarding the protection against Server Side Request Forgery (SSRF) attack. This cheat sheet will focus on the defensive point of view and will not explain how to perform this attack. |
| Server Side Request Forgery | Server-side request forgery (or SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. |
| Server-Side Request Forgery | Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf. The service nip.io is awesome for that, it will convert any ip address as a dns. |
| Fun with SSRF - Turning the Kubernetes API Server into a port scanner | I thought I’d start the new year with something a little fun that I’ve been looking at over the break (well for a certain definition of the word ‘fun’ :) ). |
| raesene/k8s_ssrf_portscanner | This is a Proof of concept idea for using the Kubernetes API server as a port scanner via SSRF. This is a very simple PoC and is not intended to be used in production! |
| SSRF Series | SSRF (Server-Side Request Forgery: server-side request forgery) is a fake exploit server-initiated requests. Generally, SSRF attacks target internal systems that are not accessible from the external network. 1. Show response to attacker (basic) 2. Do now show response (blind) |
| Server Side Request Forgery (SSRF) | |
| AllThingsSSRF | This is currently work in progress I will add more resources as I find them. Detectfy - What is server side request forgery (SSRF)? |
| Escalating SSRF to Accessing all user PII information by aws metadata | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to leaked all user PII information by SSRF aws metadata exploitation. Don’t go outside without any reason . Stay home be safe and also safe other. |
| CodeNinja | Posted on June 27, 2021 |
| Useful Mind Maps | Useful Mind Maps Collection 1. IDOR Techniques 2. Testing 2FA 3. 2FA Bypass Techniques 4. Bugs in Register/ Signup Feature 5. Cookie_Based_Authentication_Vulnerabilities 6. SSRF 7. Tesing JIRA for CVE’s 8. OAUTH2 Pentesting Checklist 9. Testing OAUTH 10. |
| The story of how I was able to chain SSRF with Command Injection Vulnerability | Hope you’re doing well, I am Raj Qureshi and I am a penetration tester. today I am doing another write-up about one of my best findings ever. In this write-up, I will be describing how I was able to chain SSRF attack with command injection Vulnerability. |
| SSRF’s up! Real World Server-Side Request Forgery (SSRF) | In this blog post we’re going to explain what an SSRF attack is, how to test for it, and some basic guidelines on how to fix it. We will be using a real-world example, exploiting a vulnerability we discovered in a commercial Business Intelligence product called Dundas BI. |
| A Pentester’s Guide to Server Side Request Forgery (SSRF) | What is SSRF? In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL, which the code running on the server will read or submit data. |
| Top 25 Vulnerability Parameters based on frequency | For basic researches, top 25 vulnerable parameters based on frequency of use with reference to various articles. These parameters can be used for automation tools or manual recon. |
| Server Side Request Forgery (SSRF) and AWS EC2 instances after Instance Meta Data Service version… | Having blogged about exploiting SSRF on AWS EC2 instances in the past, we wanted to give you an update on where things stand now. Server Side Request Forgery can be an extremely lucrative finding to an attacker because of the ability to make requests from the target machine. |
| Block or report hackerscrolls | Contact GitHub support about this user’s behavior. Learn more about reporting abuse. |
| SSRF | |
| /home/six2dez/.pentest-book | /home/six2dez/. |
| Web ApplicationApril 7, 2022Server-Side Request Forgery (SSRF) | SSRF vulnerabilities allow an attacker to send crafted malicious requests from the back-end server of a vulnerable application. Criminals usually operate SSRF attacks to target internal systems that are behind firewalls and are not unrestricted from the external network. |
| Understanding and Testing for SSRF | Clint Kehr Ethical Hacker Senior Instructor |
| Server-Side Request Forgery (SSRF) Attacks: The Ultimate Guide | Several significant cybersecurity breaches in recent years, including Capital One and Microsoft Exchange, involved server-side request forgery (SSRF) as a penetration method. These exploits can give attackers access to your organization’s most sensitive data. |
| How To: Server-Side Request Forgery (SSRF) | Server-Side Request Forgery, SSRF for short, is a vulnerability class that describes the behavior of a server making a request that’s under the attacker’s control. This post will go over the impact, how to test for it, the potential pivots, defeating mitigations, and caveats. |
| Beginner Guide To Exploit Server Side Request Forgery (SSRF) Vulnerability | Server Side Request Forgery (SSRF) is simply an attack where the server will make a request (act like a proxy) for the attacker either to a local or to a remote source and then return a response containing the data resulting from the request. |
| WSTG - v4.2 | Web applications often interact with internal or external resources. While you may expect that only the intended resource will be handling the data you send, improperly handled data may create a situation where injection attacks are possible. |
| Burp Suite For Pentester: HackBar | Isn’t it a bit time consuming and a boring task to insert a new payload manually every time for a specific vulnerability and check for its response? |
| SSRF (Server Side Request Forgery) testing resources | Status codes: 300, 301, 302, 303, 305, 307, 308 |
| MindMaps 🗺️ | This repository stores and houses various Mindmaps for bug bounty Hunters🧑🦰, pentesters🧑🦰 and offensive(🔴)/defensive(🔵) security Professionals🫂 provided by me as well as contributed by the community🧑🏻🤝🧑🏽. |
| Carrying Out Your First SSRF Attack | Hi, within this lecture we're going to do our first SSRF attack so that you can understand this in a much better way while implementing it or executing it yourself. So, let's see the example over here. So, it says that consider like an e-commerce application or e-commerce website. |
| Name already in use | Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today: |
| Server-Side Request Forgery (SSRF) | In this chapter, we are going to learn about server-side request forgery (or also called SSRF). In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. |
| URL Format Bypass | |
| SSRF and Open Redirect CheatSheet | SSRF Basic ?url=http://localhost/server-status ?url=http://127.0.0.1/server-status ?url=http://internal_domain/page ?url=http://internal_ip(192.138.0.14)/page Bypass SSRF with Special chars ?url=http://allow_domain. |
| My First Bounty From SSRF: From Finding a Vulnerability to Cashing In | Hello peoples, I’m Muhammad Julfikar Hyder from Bangladesh back again with my first bounty story today. You can also read my previous blog here How I hacked LINE’s bucket. |
| Server-Side Request Forgery(SSRF) CYBERTALENTS | Server Side Request Forgery is a web security vulnerability that allows the attacker to interact with the internal infrastructure of the target which is not accessible from outside the target network. |
| 1. The Accidental SSRF | OWASP top 10 includes SSRF in the categories, still finding SSRF can usually be tricky. These attacks occur when an application is fetching data from a user-supplied URL, without any validations. |
| Server-Side Request Forgery (SSRF) involves an attacker tricking a server into making unauthorized… | Server-Side Request Forgery (SSRF) involves an attacker tricking a server into making unauthorized requests on behalf of the attacker. This type of attack can be hazardous, as it can allow the attacker to gain access to sensitive information, such as user data or internal network details. |
| yeswehack/vulnerable-code-snippets | YesWeHack present code snippets containing several different vulnerabilities to practice your code analysis. The code snippets are beginner friendly but suitable for all levels! |
| A Glossary of Blind SSRF Chains | What is Server Side Request Forgery (SSRF)? Server Side Request Forgery occurs when you can coerce a server to make arbitrary requests on your behalf. As the requests are being made by the server, it may be possible to access internal resources due to where the server is positioned in the network. |
| Hey man if I talk about the impact it is comparatively low than that of normal ssrf because of its… | Hey man if I talk about the impact it is comparatively low than that of normal ssrf because of its one way nature. The only impact it has is you can steal the internal IPs and in rare case it can lead you to RCE. |
| Server-Side Request Forgery (SSRF)- PortSwigger Labs | This lab has a stock check feature that fetches data from an internal system. To solve the lab, use the stock check functionality to scan the internal 192.168.0.X range for an admin interface on port 8080, then use it to delete the user carlos. |
| SSRF Vulnerability From a Developer’s Perspective | OWASP Top 10 provides users a list of vulnerabilities in the field of application security. This list is prepared based on the severity of the occurrence of an attack, SSRF is one of them. |
| Let’s Understand SSRF vulnerability | In most cases, the OWASP Top 10 will publish a list of vulnerabilities. These are the broad categories that encompass the various types of vulnerabilities. |
| 👩💻Roadmap to Cybersecurity in 2022, Full-Read SSRF, IDOR in GraphQL, GCP Pentesting, and much… | Watch this talk about $25 billion+ of value, locked in the practical attacks against bridges. Welcome to the #IWWeekly28 — the Monday newsletter that brings the best in Infosec straight to your inbox. |
| 👩💻 $600k Bounty, Jetty Features, Response Queue Poisoning, Bypass SSRF Protections, XSS… | This simple business logic flaw in smart contracts resulted in a $600K bounty. Welcome to the #IWWeekly26 — the Monday newsletter that brings the best in Infosec straight to your inbox. |
| Exploiting XXE for SSRF | Server-Side Request Forgery (SSRF):- SSRF is an attack in which an attacker can force a vulnerable server to trigger malicious requests to third-party servers and or to internal resources. |
| Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports | In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw. SSRF is when you, as an attacker, successfully make the application triggering arbitrary requests. |
| Dark Side 108: Intro to SSRF | Today’s challenge demonstrated a Server-Side Request Forgery attack. As it sounds, this attack tricks a website into letting a user into the backend server supporting a public facing web application. These vulnerabilities usually exist as a result of improper error handling… |
| A Pentester’s Guide to Server Side Request Forgery (SSRF) | This blog will be one of many created alongside our Hacking How-To series, an educational video series around everyday pentest findings. The first installment will explore Server Side Request Forgery (SSRF). |
| AWS internal metadata accessed through SSRF by Chaining an Open Redirect bug | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to get AWS metadata accessed through SSRF by chaining it with a open direct vulnerability This is the write of my Recent bug that i found . |
| SSRF payloads | The service nip.io is awesome for that, it will convert any ip address as a dns. Allows an attacker to fetch any content from the web, it can also be used to scan ports. |
| How i converted SSRF TO XSS in jira. | Before i start Acunetix does Subdomain scans so just set the time out to 20 and you will get a really big list with banners and response headers. (it does the half of the work for you.) Now, i een through lots of subdomains and i was specifically looking for any jira environment , and i found one. |
| Finding SSRF via HTML Injection inside a PDF file on AWS EC2 | During a recent application vulnerability assessment we found a Stored HTML Injection vulnerability that was quickly escalated to a full Server Side Request forgery (SSRF) on a AWS EC2. We test a lot of applications hosted in AWS, especially on EC2. |
| Blind SSRF - The Hide & Seek Game | Hello everyone I wanted to share one of my finding related to Blind SSRF on a private program on HackerOne for which they paid me $400. Blind SSRF vulnerabilities occur when an application is making a request to a back-end server due to some reasons but the response is not shown on the front-end. |
| Exploiting: SSRF For Admin Access | Server-Side Request Forgery (SSRF):- SSRF is an attack in which an attacker can force a vulnerable server to trigger malicious requests to third-party servers and or to internal resources. |
| Server-Side Request Forgery | Server-side request forgery, or SSRF, is a vulnerability that allows an attacker to use a vulnerable server to make HTTP requests on the attacker’s behalf. This is similar to CSRF as both the vulnerabilities perform HTTP requests without the victim acknowledging it. |
| From SSRF To RCE in PDFReacter | What is PDFReacter? - PDFReacter is a parser which parses HTML content from HTML to PDF. While testing an application I have identified that an application is using the PDFReacter parser. |
| Server Side Request Forgery (SSRF) Testing | Well this story is just for fun testing SSRF not a bounty write up. I found a random web that vulnerable to SSRF but in order to exploit it i should convert my input to base64. Here is the site . If i decode the base64 then i got this pacman game site http://www.top80sgames.com/site/content/pacman. |
| Exploiting an SSRF: Trials and Tribulations | I mostly wanted to share this post not because it’s a novel and unique attack, but to show the thought process of attacking this particular functionality, and understanding how the system works to identify what would and would not work. |
| Chaining an Blind SSRF bug to Get an RCE | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be Discussing how I was able to get RCE by using Blind SSRF. But still there is a chance that will will missing some url. |
| SSRF | Not all SSRF vulnerabilities return the response to the attacker. This type of SSRF is known as blind SSRF To demonstrate we will use test.smtp.org testing server. |
| Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text | This post is about how I and my friend got roughly 2500$ from Cafebazaar bug bounty program. During the recon phase, I enumerated the mailx.hezardastan.net host, the Cafebazaar’s webmail access. I conducted a port scanner: |
| My First Bug: Blind SSRF Through Profile Picture Upload | Hello all! This is a writeup for my first bug, an SSRF! My next writeup will most likely be about my specific approach to learning in bugbounty hunting which I hope will be massively helpful for newcomers. Feel free to follow me right here on medium, or on twitter for updates. |
| Story Behind Sweet SSRF. | Hey everyone! I hope you all are doing well! Rohit soni is back with another write-up and this time it’s about critical SSRF which leads to AWS credentials disclosure. Let’s dive into it without wasting time. |
| PHP SSRF Techniques | In this article, I want to go deep on a few SSRF techniques that you can use against a PHP script that use filters like filter_var() or preg_match() and get HTTP contents using curl or file or file_get_contents(). |
| Story of a really cool SSRF bug. | Hello all! My name is Vedant, also known as Vegeta(on twitter). I’m a cybersecurity enthusiast and a bug bounty hunter. This is my first write-up of 2021. This write-up is about a SSRF vulnerability that allowed me to access the AWS metadata of the target company. So let’s get started, |
| How Github recon help me to find NINE FULL SSRF Vulnerability with AWS metadata access | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to to find 9 full SSRF vulnerability with AWS metadata access BY doing some GITHUB recon. Don’t go outside without any reason . Stay home be safe and also safe other. |
| Finding SSRF BY Full Automation | My name is Santosh Kumar Sha, I’m a security researcher from India(Assam). In this article, I will be describing how I was able to Find ssrf vulnerability by bu automating it and leak private information amazon metadata, ec2 and cloud services. |
| Reading Internal Files using SSRF vulnerability | Neeraj SonaniyaOct 16, 20172 min read·I am hunting on one private program since last 8 months, since it doesn’t allow disclosure i will keep organization REDACT, in requests i will use ‘example.com’ as its name. |
| Intro to SSRF | Successful cyberattacks often start at the “network perimeter”. As a company grows, it becomes increasingly difficult to secure the hundreds and thousands of machines on the network. |
| The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise! | Hi Guys, Back with an interesting hack that I was eagerly waiting to get the writeup to publish. This hack is about a chain of vulnerabilities which includes multiple bypasses in a various different layer which finally lead to access of AWS credentials in India’s biggest stock broker company. |
| $10000 Facebook SSRF — Bug Bounty | This is a write-up about a SSRF vulnerability I found on Facebook. The vulnerability could have allowed a malicious user to send internal requests to the Facebook corporate network. |
| Vimeo upload function SSRF | As you can see, It sends the file URL with google authorization to let the backend server fetch the file from the url and pass the authorization on the header to access the file from google drive. |
| Just Gopher It: Escalating a Blind SSRF to RCE for $15k | The bug bounty program which this vulnerability was discovered on has not allowed for public disclosure, therefore I will not be directly naming the program involved. What I can say — this was discovered on the main scope of one of Hackerone’s longest-running, largest bug bounty programs. |
| Bypassing SSRF Protection | Ok. So you’ve found a feature on a web application that fetches external resources. You’re able to pull content from all sorts of external sites and there doesn’t seem to be any restrictions on the file type that you can request… The application displays everything right back at you. |
| SSRF - Server Side Request Forgery (Types and ways to exploit it) Part-1 | What is SSRF? Server Side Request Forgery (SSRF) refers to an attack where in an attacker is able to send a crafted request from a vulnerable web application. |
| How i found an SSRF in Yahoo! Guesthouse (Recon Wins) | As i said before sharing is caring, here i am describing one of my findings that was closed 2 weeks ago in yahoo Guesthouse https://gh.bouncer.login.yahoo.com/ and i am describing in details, how recon helped me finding a vulnerable endpoint where i achieved the SSRF. |
| SSRF in the Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| Vimeo SSRF with code execution potential. | Recently I discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how I found & exploited it. So let's get started. Vimeo provides an API console for their API called API Playground, The requests made using this web app is done from server-side. |
| Multiple HTTP Redirects to Bypass SSRF Protections | I needed to utilize many known SSRF techniques at once to successfully exploit many endpoints in the same company. After discovering away, I applied it to all functionalities that use attacker-controlled URLs and found 2 blind and 1 full read SSRFs. |
| lorsrf | lorsrf Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST Methods NOTE Lorsrf has been added to scant3r with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more)) https://github. |
| What is Server-Side Request Forgery (SSRF)? | Server-side request forgery (SSRF) vulnerabilities let an attacker send crafted requests from the back-end server of a vulnerable web application. Criminals usually use SSRF attacks to target internal systems that are behind firewalls and are not accessible from the external network. |
| An overlooked parameter leads to a critical SSRF in Dropbox bug bounty program | Check out Intigriti: https://www.intigriti.com/ 📧 Subscribe to BBRE Premium: https://bbre.dev/premium ($20 OFF with code BIRTHDAY) ✉️ Sign up for the mailing list: https://bbre.dev/nl 📣 Follow me on Twitter: https://bbre.dev/tw This video is an explanation of an SSRF found by Harsh Jaisw |
| SVG SSRF Cheatsheet | Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. |
| Capital One SSRF | Kontra | |
| Awesome SSRF writeups | This is currently work in progress I will add more resources as I find them. |
| 10 Types of Web Vulnerabilities that are Often Missed | Detectify Crowdsource is not your average bug bounty platform. It’s an invite-only community for ethical hackers passionate about securing modern technologies and end users. |
| SSRF In The Wild | This is an analysis of publicly disclosed SSRF vulnerabilities. I will go into where these vulnerabilities were found, the criticality of these bugs, and the fixes implemented by the vendor after the report. |
| 🔥 ssrf-king 🔥 | 🔥 ssrf-king 🔥 v1. |
| How i found 3 SSRF in one day on different bug bounty targets. | My name is damanpreet singh. This is my first write-up, so please forgive me for my mistakes. So, lets start: I started bug bounties after about a year. I was only learning, still i am learning. So, some days ago i thought , now i should start to looking for bugs. |
| Server Side Request Forgery | Server side request forgery is one of the web vulnerabilities which allows an attacker to use the backend server to make unintended requests to the internal systems. |
| The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise! | Hi Guys,Back with an interesting hack that I was eagerly waiting to get the writeup to publish. This hack is about a chain of vulnerabilities which includes multiple bypasses in a various different layer which finally lead to access of AWS credentials in India’s biggest stock broker company. |
| Vimeo SSRF with code execution potential. | Recently i discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how i found & exploited it. So lets get started. Vimeo provides an API console for their API called API Playground, The requests made using this web app is done from server side. |
| [bugbounty] A Simple SSRF | |
| B-XSSRF - Toolkit To Detect And Keep Track On Blind XSS, XXE And SSRF | Toolkit to detect and keep track on Blind XSS, XXE & SSRF. |
| SSRF bible. Cheatsheet - Google Docs | |
| B-XSSRF | B-XSSRF Toolkit to detect and keep track on Blind XSS, XXE & SSRF SETUP Upload the files to your server. Create a Database and upload database.sql file to it. Change the DB Credentials in db.php file. Ready. USAGE BLIND XSS <embed src="http://mysite.com/bxssrf/request. |
| SSRF Vulnerability due to Sentry misconfiguration | That story happened when I saw that disclosed report. And funny thing is that I remembered that saw some Sentry requests in my BuprSuit Proxy in my current project. From that point of view, I highly recommend to not filtering Proxy history. |
| SVG XLink SSRF fingerprinting libraries version | Since parser is blocking SYSTEM based entities our attack surface has been limited, Now it’s time to test Billion Laughs attack since application allowed static entities. |
| AWS takeover through SSRF in JavaScript | Here is the story of a bug I found in a private bug bounty program on Hackerone. It took me exactly 12h30 -no break- to find it, exploit and report. |
| Into the Borg – SSRF inside Google production network | In March 2018, I reported an XSS in Google Caja, a tool to securely embed arbitrary html/javascript in a webpage. In May 2018, after the XSS was fixed, I realised that Google Sites was using an unpatched version of Google Caja, so I looked if it was vulnerable to the XSS. |
| Server Side Request Forgery (SSRF) Testing | Well this story is just for fun testing SSRF not a bounty write up. I found a random web that vulnerable to SSRF but in order to exploit it i should convert my input to base64. Here is the site http://playfreedownloadgames.com:2483/proxy. |
| How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! | Hi, it’s been a long time since my last blog post. In the past few months, I spent lots of time preparing for the talk of Black Hat USA 2017 and DEF CON 25. Being a Black Hat and DEFCON speaker is part of my life goal ever. This is also my first English talk in such formal conferences. |