A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

on YouTube ↗50m

" summary

Demonstrates a practical exploit chain that turns URL parser inconsistencies into SSRF bypasses and real RCE: a custom fuzzing tool finds parsing mismatches across Python, PHP, Perl, Ruby, Java, JavaScript, Wget and cURL, yielding 20+ zero days in libraries and apps (WordPress, vBulletin, MyBB, GitHub). Shows concrete bugs — curl vs. PHP parsing, double URL decoding, Unicode and SNI hostname tricks, space/newline injections — and a working GitHub Enterprise demo that uses protocol smuggling + memcached object injection to achieve remote code execution.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 1:30About Orange Tsai
3. 5:15Protocol Smuggling in SSRF
4. 6:26Quick Fun Example
5. 12:05URL Parsing Issues
6. 19:21NodeJS Unicode Failure
7. 22:31GLibc NSS Features
8. 29:34Abusing IDNA Standard
9. 31:21Abusing URL Parsers - Case Study
10. 36:28Protocol Smuggling - Case Study
11. 46:07Bug Bounty - Case Study
12. 47:19Mitigations
13. 48:05Summary

" related talks

• 47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai · Black Hat Asia 2018
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 50mModern WebApp VulnerabilitiesErlend Oftedal · Øredev 2019
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 45mKnow Your Enemies: Live Exploit of a PHP Engine Security BreachAlexandre Daubois · PHP UK Conference 2026