‫Now.
‫On the modern Web, Web applications can request data from other applications or services.
‫So what this does is triggers requesting in between web servers and server side request forgery or as
‫SRF vulnerabilities occur right here at this point, at this juncture.
‫So if this entire server requesting is not implemented correctly and there is a correct way to do it,
‫an attacker may leverage SRF to perform malicious actions.
‫So somehow if an attacker can control the parameter in such a request.
‫This attacker will be able to force the application to request services available through the loopback
‫interface.
‫So SRF attacks are generally used to target internal systems that are behind firewalls and are not necessarily
‫accessible from the external network.
‫All right, sounds intriguing.
‫Hmm.
‫So let's have a look at how it works.
‫So open up, Kelly, and log in to be Web.
‫Now open a server side request forgery page from the dropdown menu, and here I will display the page.
‫But we've got nothing to do with this page, right?
‫It just shows us the way.
‫So SRF, right, is all about bypassing access controls and then making a request on behalf of the target
‫server, in our case, that'll be Bibox.
‫So it means that we can use the target server as a proxy to request other resources on the network.
‫And there are a few ways to force the target to make requests.
‫RFI and XXXI are some of the ways that we can force Bibox to bring other resources onto the network.
‫So I'm going to start with RFI.
‫So go to RL if I got BHP.
‫And we know there is a fire inclusion in the language parameter.
‫So we could include a password file like that.
‫And now we need to turn file inclusion into a mechanism that requests other resources.
‫OK?
‫For instance, we can use this payload and it will request a page on Port 22.
‫Wait for a bit.
‫And we get warnings which expose detailed version information right about the SSA service on the system,
‫so that way we can learn the ports and services on the system.
‫OK, so I have an HMO page in my Web root directory.
‫And the content is like that because my attacking machine, Kelly is also on the same network as be
‫by.
‫So I can include any page or resource from Kelly.
‫OK.
‫And I'm going to paste this payload.
‫And you see it works.
‫So it's a simple file inclusion.
‫But this time the file is somewhere on the local network.
‫OK, so go back to terminal.
‫Under the evil folder, there are three text files prepared for SRF.
‫I'm just going to show you the first one.
‫So this code scans a network for these ports on Line 28.
‫Then, Prince, the result.
‫So we're going to use this file, so exit.
‫And open Firefox.
‫And I'm going to use SRF one that text like that.
‫And perform.
‫And it will perform a port scan on the target server box, but don't get confused.
‫This file is also in the be web directory in B box, right?
‫However, I don't include it from there.
‫I include it from Kelly.
‫OK, so you can change the IP to another one in the local network.
‫And then you can scan it for these ports as well.
‫So type 127.0.0.1.
‫Or type local host.
‫And I can scan Kelly as well.
‫And look at that only Apache is running on Port 80 now.
‫I could also scan my host.
‫Wait, just a bit for the results.
‫OK, so here's a resume.
‫You know, open these ports for this purpose.
‫And look what it discovers.
‫All right, so then go back to the are off main page.
‫All right, so the second vulnerability to request resources on the local network, I said, was x x
‫e oh, go to exec c one dot BHP.
‫Then enable foxy proxy.
‫And click here.
‫The request is in burb, so send the request to repeater, then go to repeater.
‫Send the first request to check the connection.
‫All right, so we have seen the excessive vulnerability.
‫So if you type something, it will reflect it to you.
‫OK, so instead of this XML data, I'm going to use this one.
‫So it requests the robots that direct file on box, but I write the local host.
‫So you can change this to any IP on the local network to read, well, any other resources.
‫I'm going to stop here, but you can go ahead and continue because the rest is an ex sexy attack.
‫So please try and go as far as you can and traverse in a local network.
‫I know, you know how.