KZhead
Ғылым және технология

Server-Side Request Forgery (SSRF) | Complete Guide

Rana Khalil
2024 ж. 22 Мам.
61 473 Рет қаралды
Жүктеу

In this video, we cover the theory behind Server-Side Request Forgery (SSRF) vulnerabilities, how to find these types of vulnerabilities from both a white box and black box perspective, how to exploit them and how to prevent them.
▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: bit.ly/30LWAtE
▬ 📖 Contents of this video 📖 ▬▬▬▬▬▬▬▬▬▬
00:00 - Introduction
00:30 - Web Security Academy Course (bit.ly/30LWAtE)
01:42 - Agenda
02:36 - What is a SSRF vulnerability?
18:13 - How to find SSRF vulnerabilities?
26:50 - How to exploit SSRF vulnerabilities?
41:23 - How to prevent SSRF vulnerabilities?
45:42 - Resources
46:42 - Thank You
▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
Video slides: github.com/rkhal101/Web-Secur...
Web Security Academy: portswigger.net/web-security/...
OWASP - SSRF: owasp.org/www-community/attac...
Server-Side Request Forgery Prevention Cheat Sheet: cheatsheetseries.owasp.org/ch...
SSRF Bible Cheat Sheet: cheatsheetseries.owasp.org/as...
Preventing Server-Side Request Forgery Attacks: seclab.nu/static/publications...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!: www.blackhat.com/docs/us-17/t...
Rana's Twitter account: / rana__khalil
Hacker Icons made by Freepik: www.freepik.com

Пікірлер

  • Just picking a random video from your channel to tell you that you're doing a marvelous teaching job! You managed to explain very complex topics in a very gentle and simple way, I hope I could one day reach a tenth of your teaching quality. Congratulations and thank you so much for your work

    @davidlakomski3919@davidlakomski3919 Жыл бұрын

    • Thank you! I appreciate the kind words ❤

      @RanaKhalil101@RanaKhalil101 Жыл бұрын

  • Look forward to more great tutorials! One of the best and comprehensive talks on this subject!

    @rongliao9255@rongliao92554 ай бұрын

  • Thank you Rana ! I really appreciate your effort. These videos are really wonderful

    @emrah2525@emrah25257 ай бұрын

  • Great video and explanation Rana! thanks for sharing this high quality content!!!

    @PhilocyberWithRichie@PhilocyberWithRichie Жыл бұрын

  • Great teacher and very well taught .... Explained very well.

    @anjulgrover2114@anjulgrover211411 ай бұрын

  • Have you considered starting a patreon? You're a great teacher, I think people would be willing to support you through that route as well

    @buttslaya@buttslaya2 жыл бұрын

  • I have watched a couple of videos, but I struggled to grasp the meaning of SSRF. However, after watching your video, I gained a much clearer understanding. Jazakallah khairan, sister Rana 🤲

    @tullacss@tullacss3 ай бұрын

  • Your videos are much awaited.Please upload videos continuously❤❤❤❤❤❤❤❤❤

    @spsumon1298@spsumon12982 жыл бұрын

  • أحبك في الله يا أختي والله سهلتي علي المعلومات بصورة جميلة وواضحة بارك الله فيك وجزاك الله كل خير على هذا الشرح الرائع والمتميز

    @MAX-nv6yj@MAX-nv6yj Жыл бұрын

  • cant stop watching your videos and learning! you make learning these complex subjects so easy! i just subscribed to your course to do more hands-on 😊😊

    @ghinwabadawi983@ghinwabadawi9832 ай бұрын

    • Thanks Ghinwa!

      @RanaKhalil101@RanaKhalil1012 ай бұрын

  • This is awesome just saw you on David Bombal and I can see why such a great tech name recommends you. Great work👍

    @josephgitahi2090@josephgitahi2090 Жыл бұрын

  • thx for the video, it really clarified my knowledge on SSRF. Thankyou so much for making this video, you are a great teacher. Consider making a patreon like the guy down below said.

    @NoobJang@NoobJang5 ай бұрын

  • This is superb, thank you so much!!

    @Sec1515@Sec1515 Жыл бұрын

  • Totally Awesome! Thank you !

    @JohnSmith-wz7he@JohnSmith-wz7he2 жыл бұрын

  • Was waiting for this.

    @zTech300@zTech3002 жыл бұрын

  • Need Videos For Every Portswigger Labs Ur Videos are easily understandable

    @manbeats6702@manbeats67022 жыл бұрын

  • Amazing vid, shukran sis!

    @zuberkariye2299@zuberkariye22992 жыл бұрын

  • Thanks for the video

    @macleo7825@macleo78252 жыл бұрын

  • Mam please upload more videos on client side and server side attacks....Your videos are much awaited...Please upload videos on XSS soon...waiting for that

    @masicre9574@masicre95742 жыл бұрын

  • thanks for the content

    @JuanBotes@JuanBotes2 жыл бұрын

  • Thank you so much.

    @sawtintkyaw887@sawtintkyaw8872 жыл бұрын

  • good explanation

    @suresh_shankar@suresh_shankar6 ай бұрын

  • great job!!! you Rock!!

    @ex0day@ex0dayАй бұрын

  • Thank you

    @howandwhythingswork@howandwhythingswork2 жыл бұрын

  • Thanks sister....

    @SecurityTalent@SecurityTalent2 жыл бұрын

  • great rana but i hope u can do this in arabic version for arab white hat hackers . im so glad to see u in youtube and i will support u cuz u deserve that , big thanks and i wait a lot from u ! ty

    @alaaalmekdad9062@alaaalmekdad90626 ай бұрын

  • Thank you, it is awesome… can you advice us about oscp certification?

    @yassers1893@yassers18932 жыл бұрын

  • thank you, gracias Rana

    @brunosm0@brunosm02 жыл бұрын

  • Don't want to wait for the weekly release schedule to gain access to all the videos and want to be added to a discord server where you can ask questions? Make sure to sign up to my course: bit.ly/30LWAtE ✨✨

    @RanaKhalil101@RanaKhalil1012 жыл бұрын

    • Learning pentest is there need for programming???

      @francisdonald4298@francisdonald42982 жыл бұрын

    • @@francisdonald4298 Not necessarily but it will help you understand better and learn faster. If you're pentesting a web application and you want to perform an SQL injection attack, you'll need to 'at least', understand the syntax of PHP and how SQL is used to query a database.... If you're doing an XSS attack, you'll need to understand JAVASCRIPT.

      @chrisfx9097@chrisfx90972 жыл бұрын

  • thank youuuu

    @ahmedramadan9550@ahmedramadan95503 ай бұрын

  • precious one

    @Dy13yDx@Dy13yDx10 ай бұрын

  • One of the most precise and well-organized videos I have ever seen. Unfortunately, I'm from Iran otherwise I would definitely get your course. is there any way I can get it?

    @sinanajarha6712@sinanajarha6712 Жыл бұрын

  • Awesome

    @steiner254@steiner254 Жыл бұрын

  • kindly share a video on XXE attack

    @nibeditadhani6149@nibeditadhani61492 жыл бұрын

  • U r the best.

    @texashighered9539@texashighered95394 ай бұрын

  • Hi madam, thank you for your great content, I have a question that at 07:47, you talked about clicking on add items or delete items is an external request that will be blocked by the firewall. I just wonder why that is the case? Thank you again because your videos are giving me a lot of useful knowledge.

    @quyenthokimquang8682@quyenthokimquang8682 Жыл бұрын

    • Hello Quyen. In the "real word", real work environments often block external ip addresses from accessing internal systems and its functionalities. Imagine a monitoring system functionality inside a network that requires no authentication, for disaster recovery purposes. As it represents a risk, it can only be accessed internally by administrators. As so, if you make a request to the service, you will get blocked (e.g. firewall). WIth SSRF, you are tricking the actual application to make that request to his own server, through the loopback network interface, and as so, it is not you requesting, but the vulnerable application hosted in the server. As it is allowed to access internally, you have access. The same with "Add Items".

      @alexandreromao7978@alexandreromao7978 Жыл бұрын

  • Thanks for making this. Can you please change auto generated subtitles from Indonesian to English?

    @dub161@dub1613 ай бұрын

  • What network diagram do you know to draw?

    @SceneRewind@SceneRewind Жыл бұрын

  • Makasih rana

    @Shintowel@Shintowel Жыл бұрын

  • Rana SSRF lab 4-8 is hidden we can not wach it

    @SomLegends@SomLegends2 жыл бұрын

  • Theory is a torture😅 Time for practical

    @uaebikers@uaebikers Жыл бұрын

  • Hello ma'am it's my request please make a playlist on xss please ma'am it's my humble request please understand my above state

    @arbazalam2005@arbazalam20052 жыл бұрын

  • can you change auto-generated subtitle in English instead Indonesian, please?

    @moustafaahmed5609@moustafaahmed56092 жыл бұрын

  • I love you sist

    @lorrainenewton2338@lorrainenewton23382 жыл бұрын

  • 🤩😍

    @bhanupratapsinghtomar551@bhanupratapsinghtomar5512 жыл бұрын

  • mam, can you make course for xxs ?

    @poiuymnbvc8339@poiuymnbvc83399 ай бұрын

    • There are a slides on her githup

      @youssefwaheed4165@youssefwaheed41652 ай бұрын

  • Todo esto es casi igual al sistema bug bounty

    @hackingetico1@hackingetico1 Жыл бұрын

  • Hi Ma'am. I follow your videos. The content is great in all your videos. In this video particularly, I felt that DNS rebinding could have been explained in a more clearer way as this is my first time encountering it. Just a feedback from my side. I hope this helps you in making your content better someway.

    @muninitishkumaryaddala7814@muninitishkumaryaddala7814 Жыл бұрын

  • Love u

    @Shintowel@Shintowel Жыл бұрын

  • 🙏👌

    @ca7986@ca7986 Жыл бұрын

  • Sisterrrrrrrrrrrr u are amazinggggggggggg Jazakallah Made some bucks out of your video Some bucks wink wink

    @TheBashir007@TheBashir007 Жыл бұрын

  • Want talk toghether

    @-videoworldfadi8464@-videoworldfadi84642 жыл бұрын

  • make audio clear

    @rohitchhimpa901@rohitchhimpa901 Жыл бұрын

  • Good content but terrible voice 😨😨😨

    @anrstudio9916@anrstudio9916 Жыл бұрын

  • Thank you

    @earthlyelder@earthlyelder Жыл бұрын
KZhead