Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #ssrf

4 posts

All topics Clear tag filter

Server-side requests & parsers gopher://127.0.0.1:6379/_

SSRF5 min read

Protocol Smuggling in SSRF: gopher, dict and file Schemes

When an SSRF fetcher accepts non-HTTP schemes, the attack stops being about reaching internal HTTP and starts being about speaking arbitrary protocols. gopher:// crafts raw TCP bytes to reach Redis or SMTP, dict:// probes services, and file:// reads local files. Here is how the smuggling works and how a strict scheme allowlist stops it.

Server-side requests & parsersOverview http://10.0.0.5:8080/admin

SSRF3 min read

SSRF, Explained: When Your Server Becomes the Attacker's Proxy

Server-side request forgery turns a trusted server into a request-making proxy for the attacker, reaching internal services and cloud credentials the internet should never touch. Here is how it works and how to lock it down.

Server-side requests & parsers http://a1b2c3.oob.attacker.example/

SSRF5 min read

Blind and Out-of-Band SSRF: Detecting the Request You Can't See

When an SSRF never reflects the fetched response, the usual proof — leaked file contents or a service banner — is gone. You confirm it instead with an out-of-band callback and map the internal network by timing and error differentials.

Server-side requests & parsers http://169.254.169.254/

SSRF5 min read

Cloud-Metadata SSRF: From One URL to Full Account Takeover

On a cloud host, a single server-side request forgery aimed at the link-local metadata endpoint can hand an attacker temporary cloud credentials. Here is how the IMDSv1, GCP and Azure variants work, and how to shut the door.