Skip to main content

Questions tagged [ssrf]

Server Side Request Forgery (SSRF) is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server.

Filter by
Sorted by
Tagged with
0 votes
1 answer
99 views

How to resolve server-side request forgery (SSRF) warning for a HTTP request that takes Python package names as input?

I'm working on a function that returns a HTTP response from https://pypi.org/simple/ when Python's pip installer requests it for a package. When pushing my code onto GitHub, the CodeQL checks warn of ...
TheEponymousProgrammer's user avatar
0 votes
1 answer
56 views

Portswigger SSRF basic lab question

I am working on some portswigger labs to get good at web security. I was doing this lab at the following link: https://portswigger.net/web-security/ssrf/lab-basic-ssrf-against-localhost Spoiler, you ...
PurpleHacker's user avatar
0 votes
1 answer
291 views

SSRF trough Gopher

Gopher protocol is used a lot when exploiting SSRF, but how? a Gopher URL takes the form: gopher://<host>:<port>/<gopher-path> but let's take this example: gopher://10.10.10.3:80/...
jeff's user avatar
  • 3
0 votes
1 answer
180 views

Server Side Request Forgery Vulnerability Question

I am working on a CTF called Internal. I know there are walkthroughs available but I am trying not to look at them for the time being and try and work through things myself. The admin page that is the ...
user2334659's user avatar
0 votes
1 answer
285 views

SSRF through image searching function?

I am testing this site which has a feature where a user can enter a URL, and the site will grab all images from that URL and allow the user to use them on the site. This is my first time looking for ...
plshelpmetysm's user avatar
0 votes
1 answer
164 views

SSRF payload returns 200 ok

If i run a SSRF payload and it returns 200 ok, does it means the target is vulnerable? There is nothing that would be considerable leaked like data in a body, just the content-type to date such stuff
jonathans's user avatar
0 votes
0 answers
136 views

How to circumvent SSRF filter?

I am learning on Tryhackme.com how to circumvent SSRF filter. There is a website, let's assume it is test.com. test.com has two access points. First is /private which is restricted, and /new-user-...
userdatagram's user avatar
1 vote
2 answers
806 views

What is the effect of the "&x=" in a SSRF? Is it something related to encoding?

I'm learning SSRF. I learnt that typing &x= kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9) Everything that comes after the &x= ...
Ezau's user avatar
  • 13
0 votes
1 answer
127 views

What other methods would an attacker use for making an HTTP request that isn't Fetch() or an XHR or using the DOM?

We are running user-submitted JavaScript, server-side to be executed within a headless browser that doesn't have a DOM or any child of the window or document or location objects - because these are ...
rook's user avatar
  • 47.2k
0 votes
0 answers
74 views

Load url from CSS applied to element outside DOM

I was wondering if it's possible to kick off a network call by manipulating the style tag on an element outside the DOM (which could lead to potential SSRF if this were done server-side). I've tried a ...
winhowes's user avatar
  • 349
1 vote
1 answer
237 views

SSRF exploitation using MIME Type response

My website has an upload form for avatar, you can either upload image directly from PC or either make website grab it from another host. If the MIME Type is wrong , the response will contain the ...
Animation's user avatar
0 votes
1 answer
6k views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
Artem Fedin's user avatar
0 votes
1 answer
701 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
Bob's user avatar
  • 99
0 votes
1 answer
191 views

What exploit possible when GET request are forged as internal? [closed]

Suppose I was able to bypass CSRF check. I was able to forge any GET request and make it look like it was issued by the user himself. Is the web application vulnerable to somehow to 'Client-side' ...
Sim's user avatar
  • 5
0 votes
1 answer
481 views

What is the difference when a request is made to an open redirect vulnerable url though a browser and through the server using ssrf?

There is a url abc.com/something vulnerable to open redirect to xyz.com (fixed) I am catching requests at xyz.com to see contents of requests coming to it. When I browse abc.com/something (being ...
coderelliot's user avatar
1 vote
1 answer
170 views

Is there any way to get a unicode character that has a byte of 23?

I am pentesting a web application. It makes a backend call to another application, and I am trying to hijack that call. I have gained control over the URL path, query parameters, and fragment that is ...
Bob's user avatar
  • 99
3 votes
1 answer
941 views

Hijacking URL that ends with a trailing slash

I am pentesting an API which makes a backend call to https://example.org/ and appends any input you provide it (for example, if you provide test it will call https://example.org/test). I am trying to ...
Bob's user avatar
  • 99
0 votes
0 answers
214 views

SSRF - Internal network surfing

If an IIS web server exposes a site in INTERNET, is it possible for an attacker to access internal sites by simply modifying the host header of initial request to internet site and refer another host ...
David's user avatar
  • 5
1 vote
2 answers
1k views

Possible SSRF in image tag that takes (partial) user input?

A webapp has an img tag that partially takes userinput like so: <img src="/blah/blah/$USERINPUT.jpg"> where the first / is from the root of the domain. Could there be a vulnerability ...
weddegege's user avatar
0 votes
1 answer
2k views

SSRF Through Image Url

I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have ...
Emanuel Beni's user avatar
2 votes
0 answers
944 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
None_None's user avatar
1 vote
1 answer
4k views

What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat?

If I have a an application server that uses an implementation of JAX-RS, and is running as *.war file on an Apache Tomcat server, is there anything special that needs to be done or configured to ...
iraleigh's user avatar
  • 326
2 votes
2 answers
1k views

Why does Portswigger's solution to the lab "SSRF with whitelist-based input filter" work?

The URL with the exercise is: https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter The solution is: http://localhost:80%[email protected]/admin/delete?username=carlos A ...
Kevin1923851823's user avatar
2 votes
0 answers
253 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
Adam Johnston's user avatar
1 vote
0 answers
2k views

Burp: Out Of band resource load

I scanned a web app using Burp and it reported this vulnerability. When I click on the issue it show this request and response: Request: GET / HTTP/1.1 Host: xxxxx.burpcollaborator.net Pragma: no-...
b4da's user avatar
  • 710
2 votes
2 answers
483 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
Raimonds Liepiņš's user avatar
5 votes
1 answer
4k views

How to exploit SVG xlink-based SSRF

First, let me summarize how the SSRF works: 1) You setup an SVG image with a reference to your server via xlink. Here's an example that works: <?xml version="1.0" encoding="UTF-8" standalone="no"?...
Jack's user avatar
  • 501
2 votes
2 answers
3k views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...
pratik pattanaik's user avatar
2 votes
1 answer
500 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
just4learn2's user avatar
-1 votes
2 answers
1k views

Testing RCE and SSRF using Python SimpleHTTPServer [closed]

Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
user185823's user avatar
5 votes
2 answers
13k views

What is the difference between RFI/LFI and SSRF?

Is there any difference between those? Can we say that Server Side Request Forgery (SSRF) is a generalization of Remote File Inclusion (RFI) and Local File Inclusion (LFI)?
kozooh's user avatar
  • 165
2 votes
1 answer
556 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
user149925's user avatar
3 votes
2 answers
2k views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
Rifat Shommo's user avatar
6 votes
1 answer
4k views

What can be done with Blind SSRF?

I know SSRF can be exploited with the file:// protocol to read local files (something like path traversal) and also scan ports of hosts from the same network as the web server. but how Blind SSRF can ...
Reda LM's user avatar
  • 367
3 votes
0 answers
4k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
rakesh's user avatar
  • 31
1 vote
1 answer
1k views

SSRF PoC using fill="url(...)" with absolute path

I read this interesting report which describes a SSRF vulnerability allowing to fetch internal images by using the url property in a path element. However, even though this vulnerability most likely ...
r_31415's user avatar
  • 332
4 votes
2 answers
275 views

Potential issues allowing users to set any URL as web hook

I’m still in the planning stage so this may not be fully fleshed out, but I’m working on a SaaS project. Part of which allows users (customers of my SaaS) to configure my API to watch for events and ...
DasBeasto's user avatar
  • 1,796
1 vote
1 answer
696 views

Attacker can check external IP from a SSRF vuln?

I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?
Ben tester's user avatar
6 votes
1 answer
2k views

SSRF Attack Exploitation Scenario

In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability? ...
ErrorrrDetector's user avatar
16 votes
1 answer
17k views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
paj28's user avatar
  • 33.5k