Instructor: In this lesson, we're going to talk 2 2
about a Server-Side Request Forgery known as an SSRF. 3 3
Now, a server-side request forgery or SSRF 4 4
is a type of cyber attack 5 5
in which an attacker is able to send a request 6 6
on behalf of a web application, over to a server 7 7
or service that the web application has access to. 8 8
The goal of this type of an attack 9 9
is to abuse the trust relationship 10 10
between a web application and the server 11 11
or service that it communicates with 12 12
in order to gain access to sensitive information 13 13
or to perform malicious actions. 14 14
Now, one of the key characteristics 15 15
of a server-side request forgery 16 16
is that it allows an attacker to send a request 17 17
to a server or service that is not directly accessible 18 18
from the internet. 19 19
This can include internal systems like databases 20 20
or services that are not exposed to the public internet, 21 21
like a local host. 22 22
Now, a server-side request forgery attack 23 23
is typically going to exploit a vulnerability 24 24
in the web application such as poor input validation 25 25
or a lack of proper authentication. 26 26
For example, an attacker may exploit a vulnerability 27 27
in a web application's URL parameter 28 28
that allows them to send a request to a server 29 29
or service that the web application has access to. 30 30
The attacker can also use techniques 31 31
like URL wild card injections to craft a URL 32 32
that can bypass input validation 33 33
and trigger the server-side request forgery vulnerability. 34 34
Now, once an attacker successfully exploited 35 35
a server-side request forgery vulnerability, 36 36
they can then use the web application to access 37 37
and extract sensitive information 38 38
such as data from the internal databases 39 39
or to perform malicious actions 40 40
such as initiating a distributed denial of service attack 41 41
or data exfiltration. 42 42
It's also pretty common 43 43
for server-side request forgery vulnerabilities 44 44
to be found in web applications 45 45
that rely on external resources 46 46
like web services or cloud storage, 47 47
as well as in other microservice based architectures. 48 48
Now, the server-side request forgery vulnerability 49 49
can also be used by an attacker to reach internal systems 50 50
by interacting with that web application, 51 51
and it can allow the attacker to perform actions 52 52
that were not intended for that web application. 53 53
One of the common examples 54 54
of a server-side request forgery attack 55 55
is an attacker using a cloud storage 56 56
or other web service that's reachable by a web application 57 57
to send a request to an internal endpoint. 58 58
This can then allow the attacker to access sensitive data 59 59
or launch other types of attacks against internal systems 60 60
by essentially using it as a pivot point. 61 61
The best way to prevent server-side request forgery attacks 62 62
is to ensure you're using proper input validation, 63 63
authentication and access controls 64 64
in all of your applications. 65 65
Developers need to ensure their web applications 66 66
properly validate any input received from a user, 67 67
including URLs and IP addresses in order to prevent 68 68
these server-side request forgery attacks. 69 69
Also, developers need to ensure their web applications 70 70
have proper authentication and access controls in place 71 71
to prevent unauthorized access to any internal systems 72 72
or services that may be reached by that web application. 73 73
Another thing you can use is a web application firewall. 74 74
A web application firewall will be used to detect 75 75
and block these SSRF attacks. 76 76
These web application firewalls 77 77
can inspect incoming requests 78 78
and detect any suspicious patterns 79 79
such as attempts to send requests to internal systems 80 80
or services that shouldn't be allowed. 81 81
By using these web application firewalls, 82 82
you can block these types of requests 83 83
and then alert your security teams 84 84
of the potential intrusion or attempt. 85 85
As a cybersecurity analyst or penetration tester, 86 86
you may be asked to test a web application to determine 87 87
if it's vulnerable to a server-side request forgery attack. 88 88
To do this, you're going to use automated tools 89 89
that can identify potential vulnerabilities, 90 90
and then you can manually test those as well 91 91
to confirm the vulnerability exists. 92 92
You can also use manual techniques 93 93
such as crafting custom payloads 94 94
to test for these SSRF vulnerabilities, too, 95 95
if you want to do it using a manual process 96 96
instead of using automated tools. 97 97
So I want you to remember that a server-side request forgery 98 98
is considered a critical threat 99 99
that faces today's modern web applications. 100 100
These server-side request forgeries can allow an attacker 101 101
to exploit those trust relationships 102 102
between web applications on servers or services 103 103
that can then lead to sensitive data exfiltration 104 104
or exposure, as well as other types of attacks 105 105
and unauthorized access to your internal systems. 106 106
Therefore, it's critical that your organization's developers 107 107
take the time necessary 108 108
to prevent server-side requests forgery attacks 109 109
by properly validating input received from users, 110 110
implementing proper authentication and access controls 111 111
and using web application firewalls to detect 112 112
and block any potential server-side request forgery attacks.