1 1 00:00:00,000 --> 00:00:01,500 In this lesson, we're going to talk 2 2 00:00:01,500 --> 00:00:05,700 about a Server-Side Request Forgery known as an SSRF. 3 3 00:00:05,700 --> 00:00:08,790 Now, a server-side request forgery or SSRF 4 4 00:00:08,790 --> 00:00:10,050 is a type of cyber attack 5 5 00:00:10,050 --> 00:00:12,030 in which an attacker is able to send a request 6 6 00:00:12,030 --> 00:00:14,670 on behalf of a web application, over to a server 7 7 00:00:14,670 --> 00:00:18,090 or service that the web application has access to. 8 8 00:00:18,090 --> 00:00:19,620 The goal of this type of an attack 9 9 00:00:19,620 --> 00:00:21,360 is to abuse the trust relationship 10 10 00:00:21,360 --> 00:00:23,430 between a web application and the server 11 11 00:00:23,430 --> 00:00:25,410 or service that it communicates with 12 12 00:00:25,410 --> 00:00:27,870 in order to gain access to sensitive information 13 13 00:00:27,870 --> 00:00:30,300 or to perform malicious actions. 14 14 00:00:30,300 --> 00:00:31,650 Now, one of the key characteristics 15 15 00:00:31,650 --> 00:00:33,480 of a server-side request forgery 16 16 00:00:33,480 --> 00:00:35,370 is that it allows an attacker to send a request 17 17 00:00:35,370 --> 00:00:38,220 to a server or service that is not directly accessible 18 18 00:00:38,220 --> 00:00:39,480 from the internet. 19 19 00:00:39,480 --> 00:00:42,120 This can include internal systems like databases 20 20 00:00:42,120 --> 00:00:45,120 or services that are not exposed to the public internet, 21 21 00:00:45,120 --> 00:00:46,860 like a local host. 22 22 00:00:46,860 --> 00:00:48,960 Now, a server-side request forgery attack 23 23 00:00:48,960 --> 00:00:50,760 is typically going to exploit a vulnerability 24 24 00:00:50,760 --> 00:00:53,850 in the web application such as poor input validation 25 25 00:00:53,850 --> 00:00:56,220 or a lack of proper authentication. 26 26 00:00:56,220 --> 00:00:58,860 For example, an attacker may exploit a vulnerability 27 27 00:00:58,860 --> 00:01:00,870 in a web application's URL parameter 28 28 00:01:00,870 --> 00:01:02,820 that allows them to send a request to a server 29 29 00:01:02,820 --> 00:01:06,060 or service that the web application has access to. 30 30 00:01:06,060 --> 00:01:07,620 The attacker can also use techniques 31 31 00:01:07,620 --> 00:01:10,770 like URL wild card injections to craft a URL 32 32 00:01:10,770 --> 00:01:12,660 that can bypass input validation 33 33 00:01:12,660 --> 00:01:16,290 and trigger the server-side request forgery vulnerability. 34 34 00:01:16,290 --> 00:01:18,420 Now, once an attacker successfully exploited 35 35 00:01:18,420 --> 00:01:20,940 a server-side request forgery vulnerability, 36 36 00:01:20,940 --> 00:01:23,190 they can then use the web application to access 37 37 00:01:23,190 --> 00:01:24,900 and extract sensitive information 38 38 00:01:24,900 --> 00:01:26,850 such as data from the internal databases 39 39 00:01:26,850 --> 00:01:29,100 or to perform malicious actions 40 40 00:01:29,100 --> 00:01:31,890 such as initiating a distributed denial of service attack 41 41 00:01:31,890 --> 00:01:33,720 or data exfiltration. 42 42 00:01:33,720 --> 00:01:34,770 It's also pretty common 43 43 00:01:34,770 --> 00:01:37,170 for server-side request forgery vulnerabilities 44 44 00:01:37,170 --> 00:01:38,670 to be found in web applications 45 45 00:01:38,670 --> 00:01:40,500 that rely on external resources 46 46 00:01:40,500 --> 00:01:42,750 like web services or cloud storage, 47 47 00:01:42,750 --> 00:01:45,930 as well as in other microservice based architectures. 48 48 00:01:45,930 --> 00:01:48,480 Now, the server-side request forgery vulnerability 49 49 00:01:48,480 --> 00:01:51,180 can also be used by an attacker to reach internal systems 50 50 00:01:51,180 --> 00:01:53,190 by interacting with that web application, 51 51 00:01:53,190 --> 00:01:55,170 and it can allow the attacker to perform actions 52 52 00:01:55,170 --> 00:01:58,230 that were not intended for that web application. 53 53 00:01:58,230 --> 00:01:59,370 One of the common examples 54 54 00:01:59,370 --> 00:02:01,380 of a server-side request forgery attack 55 55 00:02:01,380 --> 00:02:03,180 is an attacker using a cloud storage 56 56 00:02:03,180 --> 00:02:06,360 or other web service that's reachable by a web application 57 57 00:02:06,360 --> 00:02:08,880 to send a request to an internal endpoint. 58 58 00:02:08,880 --> 00:02:11,430 This can then allow the attacker to access sensitive data 59 59 00:02:11,430 --> 00:02:14,850 or launch other types of attacks against internal systems 60 60 00:02:14,850 --> 00:02:17,610 by essentially using it as a pivot point. 61 61 00:02:17,610 --> 00:02:20,490 The best way to prevent server-side request forgery attacks 62 62 00:02:20,490 --> 00:02:22,800 is to ensure you're using proper input validation, 63 63 00:02:22,800 --> 00:02:24,750 authentication and access controls 64 64 00:02:24,750 --> 00:02:26,520 in all of your applications. 65 65 00:02:26,520 --> 00:02:28,590 Developers need to ensure their web applications 66 66 00:02:28,590 --> 00:02:31,350 properly validate any input received from a user, 67 67 00:02:31,350 --> 00:02:34,500 including URLs and IP addresses in order to prevent 68 68 00:02:34,500 --> 00:02:37,050 these server-side request forgery attacks. 69 69 00:02:37,050 --> 00:02:39,570 Also, developers need to ensure their web applications 70 70 00:02:39,570 --> 00:02:42,180 have proper authentication and access controls in place 71 71 00:02:42,180 --> 00:02:44,700 to prevent unauthorized access to any internal systems 72 72 00:02:44,700 --> 00:02:48,450 or services that may be reached by that web application. 73 73 00:02:48,450 --> 00:02:51,660 Another thing you can use is a web application firewall. 74 74 00:02:51,660 --> 00:02:54,150 A web application firewall will be used to detect 75 75 00:02:54,150 --> 00:02:56,580 and block these SSRF attacks. 76 76 00:02:56,580 --> 00:02:58,260 These web application firewalls 77 77 00:02:58,260 --> 00:02:59,670 can inspect incoming requests 78 78 00:02:59,670 --> 00:03:01,590 and detect any suspicious patterns 79 79 00:03:01,590 --> 00:03:03,900 such as attempts to send requests to internal systems 80 80 00:03:03,900 --> 00:03:06,360 or services that shouldn't be allowed. 81 81 00:03:06,360 --> 00:03:08,490 By using these web application firewalls, 82 82 00:03:08,490 --> 00:03:10,020 you can block these types of requests 83 83 00:03:10,020 --> 00:03:11,460 and then alert your security teams 84 84 00:03:11,460 --> 00:03:13,770 of the potential intrusion or attempt. 85 85 00:03:13,770 --> 00:03:16,530 As a cybersecurity analyst or penetration tester, 86 86 00:03:16,530 --> 00:03:19,170 you may be asked to test a web application to determine 87 87 00:03:19,170 --> 00:03:22,230 if it's vulnerable to a server-side request forgery attack. 88 88 00:03:22,230 --> 00:03:24,660 To do this, you're going to use automated tools 89 89 00:03:24,660 --> 00:03:26,610 that can identify potential vulnerabilities, 90 90 00:03:26,610 --> 00:03:28,380 and then you can manually test those as well 91 91 00:03:28,380 --> 00:03:30,630 to confirm the vulnerability exists. 92 92 00:03:30,630 --> 00:03:32,400 You can also use manual techniques 93 93 00:03:32,400 --> 00:03:34,080 such as crafting custom payloads 94 94 00:03:34,080 --> 00:03:36,840 to test for these SSRF vulnerabilities, too, 95 95 00:03:36,840 --> 00:03:39,090 if you want to do it using a manual process 96 96 00:03:39,090 --> 00:03:41,340 instead of using automated tools. 97 97 00:03:41,340 --> 00:03:44,520 So I want you to remember that a server-side request forgery 98 98 00:03:44,520 --> 00:03:45,990 is considered a critical threat 99 99 00:03:45,990 --> 00:03:48,930 that faces today's modern web applications. 100 100 00:03:48,930 --> 00:03:51,420 These server-side request forgeries can allow an attacker 101 101 00:03:51,420 --> 00:03:53,250 to exploit those trust relationships 102 102 00:03:53,250 --> 00:03:56,160 between web applications on servers or services 103 103 00:03:56,160 --> 00:03:58,380 that can then lead to sensitive data exfiltration 104 104 00:03:58,380 --> 00:04:00,720 or exposure, as well as other types of attacks 105 105 00:04:00,720 --> 00:04:03,510 and unauthorized access to your internal systems. 106 106 00:04:03,510 --> 00:04:06,450 Therefore, it's critical that your organization's developers 107 107 00:04:06,450 --> 00:04:07,950 take the time necessary 108 108 00:04:07,950 --> 00:04:10,410 to prevent server-side requests forgery attacks 109 109 00:04:10,410 --> 00:04:13,200 by properly validating input received from users, 110 110 00:04:13,200 --> 00:04:15,870 implementing proper authentication and access controls 111 111 00:04:15,870 --> 00:04:18,630 and using web application firewalls to detect 112 112 00:04:18,630 --> 00:04:22,083 and block any potential server-side request forgery attacks.