SSRF attacks and sockets: smorgasbord of vulnerabilities

No ratings

Presented at ZeroNights 2012 by

The report described server request forgery vulnerabilities (Server Side Request Forgery SSRF) in terms of their practical applications to perform various attacks. The various vulnerabilities and attacks with the using sockets were researched. Such as controlling of the HTTP response, database operations, and even remote code execution. Special attention is given to the above attacks, relevant for the PHP interpreter. The above methods and techniques of the attacks have been developed and successfully used in the course of security audits of real web applications.