A10: Server-side request forgery (SSRF) - Burp Suite Tutorial

- [Teacher] The final set of risks in the OWASP top 10 are server side request forgery or SSRF flaws. These flaws enable attackers to convince internal infrastructure to access or abuse resources that they were never meant to expose externally. SSRF flaws differ slightly from command injection attacks. When exploiting a command injection flaw, an attacker tries to trick an internal system to perform an action on their behalf. Something like listing the contents of a directory or adding a local user account. When exploiting an SSRF flaw, the attacker tries to gain access to internal resources or to glean information about the target based on how that request is handled. If an application assumes that every URL that processes can be trusted, then the likelihood of an SSRF flaw goes way up. This brings us back to the concept of misuse and abuse cases. An attacker can type anything they want into the URL field and as long as…