Resources

Jump to bottom

Brendan Coles edited this page Dec 24, 2017 · 5 revisions

SSRF related resources:

CWE-918: Server-Side Request Forgery (SSRF) (CWE)
SSRF bible. Cheatsheet - Google Docs (@ONsec-Lab)
SSRF (Server Side Request Forgery) testing resources
[PDF] A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! (Orange Tsai at Blackhat USA - 2017-07)
SSRF Tips (xl7dev - 2016-07-03)
Exploiting SSRF using SSRF-Proxy (Snoopy, the Security Dog - 2015-05)
Server Side Request Forgery (SSRF) (Checkmate - 2015-04)
Vulnerable by Design: Understanding Server-Side Request Forgery (Mike Brooks - 2015-04)
SSRF attacks and sockets: smorgasbord of vulnerabilities (Vladimir Vorontsov, Alexander Golovko - 2012)
SSRF vs Business Critical Applications: XXE Tunneling in SAP (Alexander Polyakov - 2012)
[PDF] SSRF pwns: new techniques and stories (Vladimir Vorontsov, Alexander Golovko - 2012)