‫Now.
‫On the modern web, web applications can request data from other applications or services.
‫So what this does is it triggers requesting in between Web servers and server side request forgery or
‫as a SRF vulnerabilities occur right here at this point, at this juncture.
‫So if this inter server requesting is not implemented correctly and there is a correct way to do it,
‫an attacker may leverage SRF to perform malicious actions.
‫So somehow if an attacker can control the parameter in such a request.
‫This attacker will be able to force the application to request services available through the loop back
‫interface.
‫So SRF attacks are generally used to target internal systems that are behind firewalls and are not necessarily
‫accessible from the external network.
‫All right, sounds intriguing.
‫So let's have a look at how it works.
‫So open up, Kelly, and log in to be Web.
‫Now open a server side request forgery page from the drop down menu, and here I will display the page.
‫But we've got nothing to do with this page, right?
‫It just shows us the way.
‫So SRF right is all about bypassing access controls and then making a request on behalf of the target
‫server, in our case that'll be PAYBOX.
‫So it means that we can use the target server as a proxy to request other resources on the network.
‫And there are a few ways to force the target to make requests.
‫RFI and XXXI are some of the ways that we can force Beatbox to bring other resources onto the network.
‫So I'm going to start with RFI.
‫So go to RLF, idot BHP.
‫And we know there is a fire inclusion in the language parameter.
‫So we can include a password file like that.
‫And now we need to turn file inclusion into a mechanism that requests other resources.
‫OK, for instance, we can use this payload and it will request a page on 22.
‫Wait for a bit.
‫And we get warnings which exposed detailed version information, right, about the SSA service on the
‫system, so that way we can learn the ports and services on the system.
‫OK, so I have an e-mail page in my Webroot directory.
‫And the content is like that because my attacking machine, Kelly, is also on the same network as BEBACK.
‫So I can include any page or resource from Kelly.
‫OK, and I'm going to paste this payload.
‫And you see, it works.
‫So it's a simple file inclusion.
‫But this time, the file is somewhere on the local network.
‫OK, so go back to terminal.
‫Under the evil folder, there are three text files prepared for SRF.
‫I'm just going to show you the first one.
‫So this code scans the network for these ports online, 28.
‫Then prints the result.
‫So we're going to use this file, so exit.
‫And open Firefox.
‫And we're going to use SRF one text like that.
‫And perform.
‫And it will perform a port scan on the target server box, but don't get confused.
‫This file is also in the B Web directory in PAYBOX, right.
‫However, I don't include it from there, I include it from Carly.
‫OK, so you can change the IP to another one in a local network.
‫And then you can scan it for these ports as well.
‫So type one two seven zero zero one.
‫Or type localhost.
‫And I can scan Kelly as well.
‫And look at that, only Apache is running on porteño.
‫I could also scan my host.
‫Wait just a bit for the results.
‫OK, so here's a real.
‫And I'll open these ports for this purpose and look what it discovers.
‫All right, so then go back to the SS R.F. Main Page.
‫All right, so the second vulnerability to request resources on the local network, I said, was x,
‫x, e s o go to Xixi one that BHP.
‫Then enable Foxe proxy.
‫And click here.
‫The request is in burb, so send the request to repeater and go to repeater.
‫Send the first request to check the connection.
‫All right, so we have seen the Xixi vulnerability.
‫So if you type something, it will reflect it to you.
‫OK, so instead of this XML data, I'm going to use this one.
‫So it requests the robot text file on V box, but I write the localhost.
‫So you can change this to any IP on the local network to read well and the other resources.
‫I'm going to stop here, but you can go ahead and continue because the rest is an xixi attack.
‫So please try and go as far as you can and to reverse in a local network.
‫I know you know how.