24 lines
1.3 KiB
Markdown
24 lines
1.3 KiB
Markdown
---
|
||
note type:
|
||
- security
|
||
- theory
|
||
date: 2026-06-03
|
||
done: true
|
||
---
|
||
This is a critical web security vulnerability where an attacker manipulates a server into making unauthorised HTTP requests to internal or external resources on the attacker's behalf.
|
||
|
||
## How SSRF Attacks Work
|
||
|
||
In a typical SSRF attack, the attacker manipulates input fields (such as URL parameters, form fields, or HTTP headers) that the server uses to initiate a request. Because the request originates from the trusted server itself, it often bypasses firewalls, VPNs, and network segmentation that would block direct external access.
|
||
|
||
### Common Attack Vectors
|
||
|
||
- **Cloud Metadata Services:** Attackers often target cloud provider metadata endpoints (e.g., `http://169.254.169.254/` in AWS) to steal temporary credentials and configuration data.
|
||
|
||
- **Internal Services:** Requests can be directed to internal administrative dashboards, databases with HTTP interfaces (like MongoDB or Redis), or other backend services lacking authentication.
|
||
|
||
- **Local File System:** By using the `file://` protocol, attackers may attempt to read sensitive files on the server (e.g., `/etc/passwd`).
|
||
|
||
- **Port Scanning:** SSRF can be used to scan internal networks for open ports and running services by observing response times or error messages.
|
||
|
||
![[Pasted image 20260602161410.png]] |