Hello, everyone, and welcome to this video.
So in this video, we are going to discuss about SRF, which is also known as Silverside Request for
forgery.
First, you should know this, that a very common vulnerability, which is identified in a lot of bug
bounty programs on these crowdsourced platforms like Backroad Integrity, Sinak or one.
Also, this is a type of vulnerability which is also identified in a lot of private programs, which
you should not miss.
So let's quickly jump into what of SRF and understand what exactly is this vulnerability, which is
the class and attack vector for this venerability.
So it is a Web based bug which allows the attackers to induce server side applications to make arbitrary
SCDP request to any domain.
Attack, it might also cause the server to make a connection back to himself or to any other Web services
within the organization's infrastructure or to any third party domains or systems as well.
Now, we have understood till now that SRF basically includes inducing some HGP request to ourselves
or within the organization, to some other Web based services or any third party domains.
All right.
So let's now understand and jump into how all of SRF and understand the principle of how it actually
functions or work.
So for this, I have demonstrated a very, very simple principle example that will make everything clear
for you to understand the working of this attack.
So the first thing that happens is any attacker, which you can see over here, sends a request to example
dot com.
Remember, in this case, we have considered example, dot com to be a vulnerable Web application.
So the attacker is sending a request, which is a get request to example dot com, which is a host.
And that hacker says, I want to reach Google dot com through you.
So the server sends a request to Google dot com and then the request is finally transferred or sent
to Google dot com server as against the request that has been sent is a get request.
And the host is Google dot com this time.
So basically, the attacker has induced the action of fetching a resource from a third party or attacker
controlled domain through the vulnerable web application, which is an example dot com.
Now the Google dot com or the attacker control dot com or a Web application server may send a response
from it back to Google dot com.
And the example dot com will send a response to the attacker dot com.
And this is how SRF attack works.
Now, to sum up everything in very, very simple words, you should understand that an attacker can
make any arbitrary request to any third party domain from the one web application and get the response
of those particular requests that has been made is the main principle of SRF.
Also, you should keep in mind that the attacker may not induce any request to third party domain and
may only induce request to himself or back to his server, which he is controlling.
The attacker may also scan the internal network and get the responses of that scans onto his own server
as well.
All right, so what does the impact of SARS, so now you must have understood that the attacker can
get a lot of sensitive information from the server back to him onto his third party domain or any arbitrary
sort.
So the attacker can get unauthorized actions onto the application.
The attacker can access the data within the organization or metadata for cloud instances, as nowadays
a lot of other application providers are shifting to cloud instances like Google.
A.W. is to give some example.
Now, you may also get a lot of sensitive files from those metadata of the cloud instances, which we
are going to see ahead.
You can also make our internal report scan of the target web applications organization and identify
if there is any service which is running onto the server.
If the service is one level, then you can also able to exploit that service and you can achieve RC.
You can also know about the internal apps which are running behind a reverse proxy after a successful
identification of SRF attack.
So you're is a very, very simple example, which you can understand for how you can utilize SRF to
scan indranil services, as you can see, this is the attacker under the most top left.
And you can see there is a firewall which only allows to request, which is through put it and put four
for three.
Now, the attacker identifies as a sort of based vulnerability into the Web application.
He is also able to scan all of the ports maybe which are running on ElasticSearch Kibwana, Memcache
Redish or Wango TV on other ports as well.
So this is how the attacker is able to scan internal services by only going through port for 443, an
ID of a successful SRF into the application and then further scan all the internal services.
So I hope you guys understood in the upcoming videos we are going to see the basics of SRF and then
we'll move on to advance and how you can bypass Estacada of protection on multiple Web applications
and how to do for exploitation.
I hope you guys understood.
Thank you.