13 Server-Side Request Forgery
Server-side request forgery (SSRF) is a vulnerability that lets an attacker send requests on behalf of a server. During an SSRF, attackers forge the request signatures of the vulnerable server, allowing them to assume a privileged position on a network, bypass firewall controls, and gain access to internal services.
In this chapter, we’ll cover how SSRF works, how to bypass common protections for it, and how to escalate the vulnerability when you find one.
Mechanisms
SSRF vulnerabilities occur when an attacker finds a way to send requests as a trusted server in the target’s network. Imagine a public-facing ...
Get Bug Bounty Bootcamp now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
