WEBVTT - This file was automatically generated by VIMEO 1 00:00:05.500 --> 00:00:08.900 Welcome to the server side request forgery session, since 2 00:00:08.900 --> 00:00:11.300 server-side request, forgery was added 3 00:00:11.300 --> 00:00:14.200 to the WASP, top 10, 20 21. We decided to 4 00:00:14.200 --> 00:00:17.700 provide you an additional session to make the transition from the 2017. 5 00:00:17.700 --> 00:00:20.600 Addition. This course is based on if 6 00:00:20.600 --> 00:00:23.500 you want more details about what has changed in the top 10. 7 00:00:23.800 --> 00:00:27.900 Please refer to the previous session of. This course, this 8 00:00:27.900 --> 00:00:30.300 is the first of three parts. And for now, 9 00:00:30.300 --> 00:00:32.400 we will focus on threat analysis. 10 00:00:33.800 --> 00:00:36.700 We'll take our time to dig into what server-side request 11 00:00:36.700 --> 00:00:39.500 forgeries. Then we will discuss how 12 00:00:39.500 --> 00:00:43.500 the system can be harmed. The impact of a successful exploitation 13 00:00:42.800 --> 00:00:45.100 and give you some insights to 14 00:00:45.100 --> 00:00:49.200 identify who may want to harm your system. The 15 00:00:49.200 --> 00:00:53.200 name server side request forgery is almost self-explanatory. 16 00:00:52.800 --> 00:00:55.700 It occurs whenever I web application, 17 00:00:55.700 --> 00:00:58.400 fetches remote, resources, without validating the 18 00:00:58.400 --> 00:01:01.100 user, supplied URL, or at least parts of 19 00:01:01.100 --> 00:01:02.500 it supplied, this perimeter, 20 00:01:02.700 --> 00:01:05.900 Yes, nowadays. This is a common feature. Sometimes 21 00:01:05.900 --> 00:01:08.200 provided to end users as an alternative to 22 00:01:08.200 --> 00:01:11.400 file uploads allowing users to provide an URL 23 00:01:11.400 --> 00:01:14.300 to download and use an image as Avatar. Is 24 00:01:14.300 --> 00:01:17.300 a good example of such a feature when an application is 25 00:01:17.300 --> 00:01:20.200 vulnerable. Then the attacker is able to coerce it to 26 00:01:20.200 --> 00:01:23.600 send crafted requests to unexpected locations either 27 00:01:23.600 --> 00:01:26.800 internal or external. The 28 00:01:26.800 --> 00:01:29.800 most common server-side request, forgery flow evolves, 29 00:01:29.800 --> 00:01:32.600 three parties, the attacker the 30 00:01:32.700 --> 00:01:35.400 Application in the Target application. The 31 00:01:35.400 --> 00:01:38.700 one the attacker wants to reach through the vulnerable application. 32 00:01:39.700 --> 00:01:43.000 First, get a curse ends a specially crafted HTTP 33 00:01:42.500 --> 00:01:45.800 request to the vulnerable application which will 34 00:01:45.800 --> 00:01:48.700 create a new request. Based on the attackers request billowed. 35 00:01:48.700 --> 00:01:51.200 The targeted application can be 36 00:01:51.200 --> 00:01:54.800 an internal or external system. The targeted application. 37 00:01:54.800 --> 00:01:57.600 Sends the response back to the vulnerable application 38 00:01:57.600 --> 00:02:00.600 and the vulnerable application sends the response back 39 00:02:00.600 --> 00:02:03.200 to the attacker, including the contents returned by the 40 00:02:03.200 --> 00:02:06.300 targeted application. Note, that, in most cases, 41 00:02:06.300 --> 00:02:09.300 from the targeted application perspective. The request was 42 00:02:09.800 --> 00:02:11.600 United in the vulnerable application. 43 00:02:13.200 --> 00:02:16.600 User control data is the most common attack Vector. Whether 44 00:02:16.600 --> 00:02:19.700 users provide full URLs or just a few parameters 45 00:02:19.700 --> 00:02:22.500 that are appended server-side to a base URL. 46 00:02:22.100 --> 00:02:25.800 If the application is vulnerable to XML external 47 00:02:25.800 --> 00:02:28.400 entity injection, then it can be exploited to 48 00:02:28.400 --> 00:02:30.900 perform a server-side request forgery attack. 49 00:02:32.600 --> 00:02:35.800 Being able to coerce the application to issue Network requests. 50 00:02:35.900 --> 00:02:38.500 May allow a attackers to perform a port scanning. Both 51 00:02:38.500 --> 00:02:41.200 an internal and external systems. When 52 00:02:41.200 --> 00:02:44.100 the target application is an external system. The attacker may 53 00:02:44.100 --> 00:02:48.400 use the vulnerable application, just to hide his activity. Attackers 54 00:02:47.400 --> 00:02:50.500 may be able to access sensitive data, 55 00:02:50.500 --> 00:02:53.400 stored in local files or other systems such 56 00:02:53.400 --> 00:02:57.300 as databases that are not exposed to the internet, accessing 57 00:02:56.300 --> 00:02:59.600 cloud services. Meta data, storage has 58 00:02:59.600 --> 00:03:02.200 been one of the most common server-side request forgery. 59 00:03:02.400 --> 00:03:05.200 Scenarios often internal systems tend 60 00:03:05.200 --> 00:03:09.500 to trust on each other more than in public facing systems exploiting 61 00:03:08.500 --> 00:03:12.000 a server-side request forgery. Vulnerability 62 00:03:11.200 --> 00:03:14.500 attackers may find a way to exploit this 63 00:03:14.600 --> 00:03:17.800 and conduct further attacks such as remote code execution on 64 00:03:17.800 --> 00:03:19.200 other internal systems. 65 00:03:20.600 --> 00:03:23.300 Threat agents, maybe someone interested on your user 66 00:03:23.300 --> 00:03:26.700 data or system internal information. Nevertheless. You 67 00:03:26.700 --> 00:03:29.500 should consider that attackers. May exploit the vulnerability in 68 00:03:29.500 --> 00:03:32.200 your application to hide their activity. While attacking a 69 00:03:32.200 --> 00:03:33.500 third party system. 70 00:03:35.300 --> 00:03:38.300 Note that this table does not exist in the WASP top. Ten twenty 71 00:03:38.300 --> 00:03:41.200 Twenty-One addition to keep this session aligned with 72 00:03:41.200 --> 00:03:45.200 the rest of the course. I've used the WASP risk rating methodology 73 00:03:44.200 --> 00:03:48.000 to compute, the exploitability detectability, and 74 00:03:47.400 --> 00:03:50.400 Technical impact. Prevalence, was 75 00:03:50.400 --> 00:03:53.800 computed based on the last top ten, twenty Twenty-One contributed data, 76 00:03:53.400 --> 00:03:56.300 take some time to review it and 77 00:03:56.300 --> 00:03:59.400 then read the server-side request forgery section. In do ask 78 00:03:59.400 --> 00:04:03.000 top 10, 20 21 website in 79 00:04:02.100 --> 00:04:03.700 the next part. 80 00:04:03.900 --> 00:04:06.300 We will exploit server-side request forgery in 81 00:04:06.300 --> 00:04:08.300 our intentionally, vulnerable application.