Information Security

Questions tagged [ssrf]

Ask Question

Server Side Request Forgery (SSRF) is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server.

18 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

SSRF Blacklist bypass using DNS Rebinding for Java Servers

I was able to bypass SSRF blacklist filter in a PHP server using DNS rebinding.However, when I tried the same for Java servers, I wasn't able to do it. The reason being, in Java servers the JVM ...
1
vote
0answers
84 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
0
votes
0answers
86 views

Burp: Out Of band resource load

I scanned a web app using Burp and it reported this vulnerability. When I click on the issue it show this request and response: Request: GET / HTTP/1.1 Host: xxxxx.burpcollaborator.net Pragma: no-...
2
votes
2answers
92 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
1
vote
1answer
530 views

How to exploit SVG xlink-based SSRF

First, let me summarize how the SSRF works: 1) You setup an SVG image with a reference to your server via xlink. Here's an example that works: <?xml version="1.0" encoding="UTF-8" standalone="no"?...
1
vote
2answers
839 views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...
1
vote
1answer
302 views

is SSRF attack or vulnerability?

I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?
-1
votes
2answers
376 views

Testing RCE and SSRF using Python SimpleHTTPServer [closed]

Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
1
vote
2answers
4k views

What is the difference between RFI/LFI and SSRF?

Is there any difference between those? Can we say that Server Side Request Forgery (SSRF) is a generalization of Remote File Inclusion (RFI) and Local File Inclusion (LFI)?
1
vote
1answer
191 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
2
votes
2answers
644 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
2
votes
1answer
1k views

What can be done with Blind SSRF?

I know SSRF can be exploited with the file:// protocol to read local files (something like path traversal) and also scan ports of hosts from the same network as the web server. but how Blind SSRF can ...
2
votes
0answers
1k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
1
vote
1answer
758 views

SSRF PoC using fill=“url(…)” with absolute path

I read this interesting report which describes a SSRF vulnerability allowing to fetch internal images by using the url property in a path element. However, even though this vulnerability most likely ...
3
votes
2answers
147 views

Potential issues allowing users to set any URL as web hook

I’m still in the planning stage so this may not be fully fleshed out, but I’m working on a SaaS project. Part of which allows users (customers of my SaaS) to configure my API to watch for events and ...
1
vote
1answer
433 views

Attacker can check external IP from a SSRF vuln?

I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?
5
votes
1answer
929 views

SSRF Attack Exploitation Scenario

In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability? ...
11
votes
1answer
7k views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...