サーãƒã‚µã‚¤ãƒ‰ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ã®å°Žå…¥ã‹ã‚‰ç”Ÿã˜ã‚‹SSRF | ã‚»ã‚ュリティブãƒã‚° | 脆弱性診æ–（セã‚ュリティ診æ–）ã®GMOサイãƒãƒ¼ã‚»ã‚ュリティ byイエラエオフェンシブセã‚ュリティ部ã®å±±å´Žã§ã™ã€‚サーãƒã‚µã‚¤ãƒ‰ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ï¼ˆSSR）ã®å°Žå…¥ã«ã‚ˆã£ã¦SSRFãŒç™ºç”Ÿã™ã‚‹å•é¡Œã‚’見ã¤ã‘る機会ãŒã‚ã£ãŸãŸã‚ã€æœ¬è¨˜äº‹ã§ã¯å®Ÿä¾‹ã‚’交ãˆãªãŒã‚‰ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ サーãƒã‚µã‚¤ãƒ‰ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ï¼ˆSSR）ã¨ã¯ï¼Ÿ 本記事ã§æ‰±ã†SSRã¨ã¯ã€Œã‚µãƒ¼ãƒä¸Šã§HTMLを出力ã™ã‚‹ã“ã¨ã€ã‚’指ã—ã¦ã„ã¾ã™ã€‚ãŸã ã—erbã‚„jspã®ã‚ˆã†ãªãƒ†ãƒ³ãƒ—レートã‹ã‚‰HTMLを出力ã™ã‚‹ã®ã¨ã¯ç•°ãªã‚Šã€ä¸€èˆ¬çš„ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ã«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ãƒ¬ãƒ³ãƒ€ãƒªãƒ³ã‚°ï¼ˆCSR）ã®æ–‡è„ˆã§ä½¿ã‚れるã“ã¨ãŒä¸»ã§ã™ã€‚ è¿‘å¹´ã®Vue.jsã‚„Reactを代表ã™ã‚‹ã‚ˆã†ãªWebフãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ãƒ•ãƒ¬ãƒ¼ãƒ ワークã¯ãƒ–ラウザ上ã§å‹•çš„ã«DOMツリーを構築ã—ã¦ç”»é¢ã‚’æ画（CSR）ã™ã‚‹ã®ãŒä¸»æµã¨ãªã£ã¦ã„ã¾ã™ã€‚ã“ã‚Œã«ã‚ˆã£ã¦ãƒšãƒ¼ã‚¸é·ç§»ã‚’挟ã¾ãšãƒ¦ãƒ¼ã‚¶ä½“験ã®ã‚ˆã„シングルページアプリケーション（SPA）ãŒä½œã‚‹ã“ã¨ãŒã§ãã‚‹ã¨ã„ã†ãƒ¡ãƒªãƒƒãƒˆãŒã‚ã‚Šã¾ã™ã€‚ ãŸã ã€å˜ç´”ãªSPAã«ã¯ãƒ‡ãƒ¡
A Glossary of Blind SSRF Chains
Blog｜URLã®å–り扱ã„ã«ã¯è¦æ³¨æ„ï¼SSRFã®æ”»æ’ƒã¨å¯¾ç–
GitHub - azu/request-filtering-agent: An http(s).Agent implementation that block request Private/Reserved IP addresses. Prevent SSRF.
Kontra Application Security Training
AppSec EU15 - Nicolas Gregoire - Server-Side Browsing Considered Harmful
SSRFを利用ã—ãŸãƒ¡ãƒ¼ãƒ«é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ä¹—ã£å–ã‚Š - Akaki I/O
GitHub - swisskyrepo/SSRFmap: Automatic SSRF fuzzer and exploitation tool
Reddit - Dive into anything
GitHub - welefen/ssrf-agent: make http(s) request to prevent SSRF
Bypassing Server-Side Request Forgery filters by abusing a bug in Ruby's native resolver
EC2上ã§DNS Rebindingã«ã‚ˆã‚‹SSRF攻撃å¯èƒ½æ€§ã‚’検証ã—ãŸ
GitHub - tarunkant/Gopherus: This tool generates gopher link for exploiting SSRF and gaining RCE in various servers
GitHub - cujanovic/SSRF-Testing: SSRF (Server Side Request Forgery) testing resources
gixy/docs/en/plugins/ssrf.md at master · yandex/gixy
{{#tags}}- {{label}}
{{/tags}}