Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Medium
SSRF with whitelist-based input filter
ssrf behind a whitelist that only allows one host, beaten by url parser confusion where embedded credentials and a double encoded
Server-side request forgery (SSRF) 5 min -
Hard
Blind SSRF with Shellshock exploitation
blind ssrf that fetches the Referer url, swept across the internal range with intruder while a shellshock command hidden in the User-Agent runs
Server-side request forgery (SSRF) 7 min -
Medium
SSRF with filter bypass via open redirection vulnerability
ssrf where the stock checker is locked to the local app, bypassed by finding an open redirect in the nextProduct path parameter and chaining it
Server-side request forgery (SSRF) 3 min -
Easy
SSRF with blacklist-based input filter
ssrf behind a blacklist that blocks the loopback string and the word admin
Server-side request forgery (SSRF) 4 min -
Easy
Blind SSRF with out-of-band detection
blind ssrf where the analytics software fetches whatever url sits in the Referer header
Server-side request forgery (SSRF) 2 min -
Easy
Basic SSRF against another back-end system
ssrf where the admin box is somewhere in an internal ip range
Server-side request forgery (SSRF) 2 min -
Easy
Basic SSRF against the local server
basic ssrf where the stock checker fetches a url we control
Server-side request forgery (SSRF) 4 min