Contents
What can you do with SSRF?
Attackers can also use SSRF to make requests to other internal resources that the web server has access to, which are not publicly available. For example, they can access cloud service instance metadata like AWS/Amazon EC2 and OpenStack. An attacker can even get creative with SSRF and run port scans on internal IPs.
What situations might cause your application to be vulnerable to SSRF?
Blind SSRF vulnerabilities arise when an application can be induced to issue a back-end HTTP request to a supplied URL, but the response from the back-end request is not returned in the application’s front-end response.
What is Ssrf medium?
Server-Side Request Forgery (SSRF) refers to an attack, wherein an attacker can send a crafted request from a vulnerable web application. SSRF is mainly used to target internal systems behind WAF (web application firewall), that are unreachable to an attacker from the external network.
What is the impact of blind SSRF vulnerabilities?
The impact of blind SSRF vulnerabilities is often lower than fully informed SSRF vulnerabilities because of their one-way nature. They cannot be trivially exploited to retrieve sensitive data from back-end systems, although in some situations they can be exploited to achieve full remote code execution .
Can you spray all of the blind SSRF payloads?
You can also spray all of these blind SSRF payloads across all of the “internal” hosts that have been identified through this method. This is often effective. To find more internal hosts, I recommend taking all of your DNS data and then using something like AltDNS to generate permutations and then resolve them with a fast DNS bruteforcer.
How to shut down a blind SSRF in Elasticsearch?
If you have a blind SSRF where you can send POST requests, you can shut down the Elasticsearch instance by sending a POST request to the following path: Note: the _shutdown API has been removed from Elasticsearch version 2.x. and up. This only works in Elasticsearch 1.6 and below: This also works via GET:
Where can I find the blind SSRF chains glossary?
You can find a GitHub repo with all of these techniques here: Blind SSRF Chains. Please send us a pull request on GitHub if you would like any more techniques to be added to this glossary.