Category Archives: SSRF

What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat?

Posted on by

If I have a an application server that uses an implementation of JAX-RS, and is running as *.war file on an Apache Tomcat server, is there anything special that needs to be done or configured to prevent SSRF attacks?

My naive understandin… Continue reading What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat?→

Why does Portswigger’s solution to the lab "SSRF with whitelist-based input filter" work?

Posted on by

The URL with the exercise is: https://portswigger.net/web-security/ssrf/lab-ssrf-with-whitelist-filter

The solution is:
http://localhost:80%2523@stock.weliketoshop.net/admin/delete?username=carlos

A little simplified (no port specified):… Continue reading Why does Portswigger’s solution to the lab "SSRF with whitelist-based input filter" work?→

What We Can Learn from the Capital One Hack

Posted on by

On Monday, a former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. Since then, many have speculated the breach was perhaps the result of a previously unknown “zero-day” flaw, or an “insider” attack in which the accused took advantage of access surreptitiously obtained from her former employer. But new information indicates the methods she deployed have been well understood for years. Continue reading What We Can Learn from the Capital One Hack→