Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How To: Server-Side Request Forgery (SSRF)

hackerone.com | vulnerability | #ruby | #web-security | #tutorial | #ssrf | #sinatra

Summary

Server-Side Request Forgery (SSRF) tutorial: using a vulnerable Ruby/Sinatra app, it covers the impact, how to test for SSRF, pivots into internal networks, defeating mitigations and caveats.
Published
Collected

original ↗

Related coverage

  1. Mitigating CWE-352: Cross-Site Request Forgery in Ruby Applications (hackerone.com)
  2. How To: Command Injections (hackerone.com)
  3. Ruby Vulnerabilities: Exploiting Dangerous Open, Send and Deserialization Operations (bishopfox.com)
  4. Unauthorized RCE in VMware vCenter (swarm.ptsecurity.com)
  5. AppFlowy Authenticated SQL Injection (projectblack.io)
  6. CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint (xbow.com)

back