EExcession Labs·1d agoSSRF: reproduce, bypass, and fix a preview endpointSSRF: reproduce, bypass, and fix a preview endpoint Server-side request forgery (SSRF) is a flaw where a server fetches a URL chosen by the caller, so the caller can reach hosts that only the server c9 min read·excessionlabs.hashnode.dev
SSina Rezaei·Oct 30Your AI Pentester Found an SSRF. Can It Reproduce the Attack?The first scan found an SSRF. The second one didn't. I wouldn't close the finding just yet. The endpoint accepts a URL, fetches the resource, and returns its response. During the first scan, the agent3 min read·sinarezaei.hashnode.dev
AAnusha Dirisala·Oct 7Your "Paste a URL" Feature Is an SSRF Waiting to HappenI wrote this article with help from an AI assistant, then reviewed, tested and edited it myself. Link previews. Webhook endpoints. "Import from URL." Avatar uploads by link. PDF generators that fetch5 min read·anushadirisala.hashnode.dev
YYogeshwar Peela·Oct 7TryHackMe - SeaSurfer writeupComplete Sea Surfer TryHackMe writeup covering vhost enumeration, SSRF, LFI, WordPress RCE, tar wildcard injection, and SSH agent privilege escalation15 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Oct 7TryHackMe: MD2PDF WriteupMD2PDF TryHackMe writeup covering HTML injection, SSRF, localhost access control bypass, internal admin access, and flag disclosure.9 min read·exploitnotes.hashnode.dev
TTrust Boundary·Sep 16The Capital One breach was not an SSRF storyEveryone remembers the server-side request forgery. The regulator's findings never mention it. What the OCC actually penalised was risk assessment and internal audit.9 min read·trustboundarystudio.hashnode.dev
YYogeshwar Peela·Aug 25HackSmarter - Casino WriteupSummary Casino is a Flask-based "Guest WiFi & Portal" resort captive portal. A leaked JS source-map exposes an unauthenticated internal API endpoint (/api/v1/rooms/status) that dumps the entire guest11 min read·exploitnotes.hashnode.dev
MMilan Nikic·Aug 18Server-Side Request Forgery: Security Architect's Perspective (Part 2)A security architect's guide to SSRF threat modeling, egress controls, cloud metadata hardening, compliance, metrics, and incident response.17 min read·securitydepth.hashnode.dev
YYogeshwar Peela·Aug 11TryHackMe : The London Bridge writeupTryHackMe London Bridge walkthrough covering SSRF, loopback bypass, root HTTP server, SSH key theft, symlink abuse, and Firefox credential recovery.18 min read·exploitnotes.hashnode.dev11N
MMilan Nikic·Aug 4Server Side Request Forgery in Java and Spring: Secure Coding PatternsLearn how to prevent SSRF in Java 25 and Spring 7 with URL validation, IP filtering, bounded responses, and DNS-safe HTTP clients.20 min read·securitydepth.hashnode.dev
