3 ms·
> SSRF is an extremely bad vulnerability; it's usually game-over on penetration tests It's usually not. What can you do via HTTP protocol inside the network? C
by homakov 10y ago
> SSRF is an extremely bad vulnerability; it's usually game-over on penetration tests
It's usually not. What can you do via HTTP protocol inside the network? Check out ssrf bible.
- greenleafjacob 10y agoYou can smuggle memcached text protocol over HTTP if you can insert a linefeed. I think tptacek meant "bad vulnerability" as in serious, not trivial.
- homakov 10y agoSSRF usually happens inside a request library that doesn't allow linefeeds. SSRF in general is serious, but HTTP GET SSRF is useless on most hosts.