Courses
1. Introduction to Blockchain and Solana
2. Setting Up Your Development Environment
3. Solana Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Solana Programs
6. Building Your First Solana Program
7. Deploying Programs on the Solana Network
8. Interacting with Solana Programs
9. Using Solana CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Solana Programs
13. Optimizing Performance on Solana
14. Exploring Solana Ecosystem Tools
1. Introduction to Blockchain and Ethereum
2. Setting Up Your Development Environment
3. Ethereum Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts
6. Building Your First Smart Contract
7. Deploying Smart Contracts on the Ethereum Network
8. Interacting with Smart Contracts
9. Using Ethereum CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Smart Contracts
13. Optimizing Performance on Ethereum
14. Exploring Ethereum Ecosystem Tools
1. Introduction to Blockchain and Polygon
2. Setting Up Your Development Environment
3. Polygon Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts on Polygon
6. Building Your First Smart Contract on Polygon
7. Deploying Smart Contracts on the Polygon Network
8. Interacting with Smart Contracts on Polygon
9. Using Polygon CLI and SDKs
10. Developing Decentralized Applications (DApps) on Polygon
11. Smart Contract Security Best Practices for Polygon
12. Testing and Debugging Smart Contracts on Polygon
13. Optimizing Performance on Polygon
14. Exploring Polygon Ecosystem Tools
1. Introduction to Cybersecurity
2. Report Writing for Penetration Testers
3. Information Gathering
4. Vulnerability Scanning
5. Introduction to Web Applications
6. Common Web Application Attacks
7. SQL Injection Attacks
8. Client-Side Attacks
9. Locating Public Exploits
10. Fixing Exploits
11. Antivirus Evasion
12. Password Attacks
13. Windows Privilege Escalation
14. Linux Privilege Escalation
15. Advanced Tunneling
16. The Metasploit Framework
17. Active Directory: Introduction and Enumeration
18. Attacking Active Directory Authentication
19. Lateral Movement in Active Directory
Advanced Server-Side Request Forgery (SSRF)
OSWE · Chapter 2
Advanced Server-Side Request Forgery (SSRF)
Advanced SSRF (Server-Side Request Forgery) goes beyond the basic "fetch this URL" case to cover bypasses of allow-lists and deny-lists — redirects, DNS rebinding, and alternate IP encodings that trick a server into requesting internal resources on the attacker's behalf.
Key concepts
- Basic SSRF: an app fetches a user-supplied URL (e.g. a webhook or avatar-from-URL feature) without restriction, letting an attacker reach internal-only services.
- Bypass techniques: redirect chains (the first request passes validation, the redirect target does not get re-validated), decimal/octal/hex IP encoding, and DNS rebinding after validation.
- Cloud metadata endpoints (e.g. 169.254.169.254) are a classic high-value SSRF target for stealing instance credentials.
- Best defense: allow-list destinations, disable following redirects in the HTTP client, and re-validate the resolved IP is not in a private range immediately before connecting (not just at input time).
Example
# Naive SSRF probe against a URL-fetching feature
curl "https://target/fetch?url=http://169.254.169.254/latest/meta-data/"Try it yourself
In a lab SSRF challenge (PortSwigger Web Security Academy has several), try bypassing an IP-based deny-list using an alternate encoding of localhost (e.g. `0177.0.0.1` or `2130706433`).