Server-Side Browsing Considered Harmful

on YouTube ↗01h 04m

" summary

Shows concrete SSRF attack chains: using dotless decimal and octal IP encodings, DNS rebinding and a dynamic HTTP redirect endpoint to bypass blacklists; targets include loopback, cloud metadata multicast and internal nets. Uses DNSChef, Burp Intruder, webbins and a custom nodejs port scanner and proxy; the scanner and Redis proxy work and yield real compromises. Reports list payouts ($500, $750, $3K, $5K, $15K, $20K) and specific library bypasses like IPy that remain exploitable.

AI-written summary · about

" chapters (11)

1. 0:00Introduction and scope
2. 2:52Identifying attack vectors
3. 8:11Target destinations
4. 12:09Loopback and metadata
5. 20:02Internal network attacks
6. 24:38Bypassing blacklists
7. 29:31IP and DNS evasion
8. 37:12Case studies and bounties
9. 47:18Advanced exploitation
10. 57:10Facebook and conclusion
11. 1:00:00Toolbox and QA

" related talks

• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 35mServer-Side Browsers: Exploring the Web’s Hidden Attack SurfaceMarius Musch · RuhrSec 2023
• 45mHTTP Desync Attacks: Smashing Into The Cell Next DoorJames Kettle · OWASP Global AppSec Amsterdam 2019
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019