4 ms·

Stunner – tool to test and exploit STUN, TURN and TURN over TCP servers

• ValtteriL 4y ago
  A handy-looking tool. In cloud infrastructure having a server side request forgery vulnerability can be fatal as it allows accessing the metadata service. Capital One was owned through one. This tool allows turning vulnerable victim systems into a proxies which allows accessing systems in the internal network, including the metadata service. Great R&D work!
  • ek750 4y ago
    I’m not a security researcher, but a normal backend dev (possibly) This comment intrigued me and led me down the typically great HN rabbit-hole. I found a couple of sources related to this, fascinating, thank you! https://www.techtarget.com/searchsecurity/news/252467901/Capital-One-hack-highlights-SSRF-concerns-for-AWS https://www.techtarget.com/searchsecurity/news/252467901/Cap... https://www.shellntel.com/blog/2019/8/27/aws-metadata-endpoint-how-to-not-get-pwned-like-capital-one https://www.shellntel.com/blog/2019/8/27/aws-metadata-endpoi... I knew about SSRFs, but the ability of attackers to pivot and stack and chain minor vulnerabilities continues to amaze me. I hope AWS mitigated this metadata endpoint weakness by now.
    • porpoisemonkey 4y ago
      > I hope AWS mitigated this metadata endpoint weakness by now. AWS offers a version 2 of the Instance Metadata Service (IMDS) API that includes mitigations for many common SSRF attacks. IIRC both IMDSv1 and IMDSv2 are turned on by default and it's a recommended AWS best practice to disable IMDSv1 when launching new instances. https://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/ https://aws.amazon.com/blogs/security/defense-in-depth-open-...
      • midasuni 4y ago
        Why isn’t best practice the default?
        • toomuchtodo 4y ago
          Backwards compatibility. Lots of legacy cloud infra and infrastructure as code written out there.