📖 What is Server-Side Request Forgery (SSRF)?
Server-Side Request Forgery (SSRF) occurs when an attacker induces a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This is often used to target internal systems behind a firewall that are not accessible from the external network.
"Watch for 'URL' or 'file' parameters in web requests. This is a prime candidate for testing if the server can be tricked into scanning its own internal network."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Server-Side Request Forgery (SSRF)?
- ▸ Internal Network Probing: Attackers leverage the server's trusted internal IP to scan ports and services that are blocked from the public internet by firewalls.
- ▸ Cloud Metadata Exploitation: Targeting specific link-local addresses, like 169.254.169.254, to retrieve sensitive IAM roles, API keys, and instance configuration data from cloud providers.
- ▸ Protocol Manipulation: Using alternative URI schemes such as file:// to read local system files or gopher:// to interact with legacy services like Redis or Memcached.
- ▸ Blind vs. Non-Blind SSRF: Non-blind SSRF returns the response body to the attacker, while blind SSRF requires observing out-of-band interactions or timing differences for confirmation.
- ▸ Input Validation Defenses: Implementing strict allow-lists for destination domains and disabling unused URL schemas to prevent the server from making unauthorized requests.
🎯 How does Server-Side Request Forgery (SSRF) appear on the PT0-002 Exam?
You may be asked to identify a vulnerability when a web application accepts a URL parameter to fetch a remote image and allows requests to localhost.
A scenario might describe an attacker attempting to steal AWS security credentials by directing a vulnerable server to request the cloud metadata service endpoint.
Expect questions where you must differentiate between XSS and SSRF; remember that XSS targets the user's browser, while SSRF targets the server's backend requests.
❓ Frequently Asked Questions
How does SSRF differ from a standard Cross-Site Request Forgery (CSRF) attack?
CSRF tricks a victim's browser into sending an unauthorized request to a server. SSRF tricks the server itself into sending a request to a target, often internal, resource.
What is the best way to test for Blind SSRF during a penetration test?
Since the server doesn't return a response, use an out-of-band tool like Burp Collaborator or a custom DNS logger to detect incoming requests from the target server.
Why is the 169.254.169.254 address so critical in cloud-based SSRF attacks?
This is the standardized link-local address for cloud metadata services. Accessing it via SSRF can expose temporary security credentials, allowing an attacker to escalate privileges within the cloud environment.