Now.
On the modern web, web applications can request data from other applications or services.
So what this does is it triggers requesting in between Web servers and server side request forgery or
as a SRF vulnerabilities occur right here at this point, at this juncture.
So if this inter server requesting is not implemented correctly and there is a correct way to do it,
an attacker may leverage SRF to perform malicious actions.
So somehow if an attacker can control the parameter in such a request.
This attacker will be able to force the application to request services available through the loop back
interface.
So SRF attacks are generally used to target internal systems that are behind firewalls and are not necessarily
accessible from the external network.
All right, sounds intriguing.
So let's have a look at how it works.
So open up, Kelly, and log in to be Web.
Now open a server side request forgery page from the drop down menu, and here I will display the page.
But we've got nothing to do with this page, right?
It just shows us the way.
So SRF right is all about bypassing access controls and then making a request on behalf of the target
server, in our case that'll be PAYBOX.
So it means that we can use the target server as a proxy to request other resources on the network.
And there are a few ways to force the target to make requests.
RFI and XXXI are some of the ways that we can force Beatbox to bring other resources onto the network.
So I'm going to start with RFI.
So go to RLF, idot BHP.
And we know there is a fire inclusion in the language parameter.
So we can include a password file like that.
And now we need to turn file inclusion into a mechanism that requests other resources.
OK, for instance, we can use this payload and it will request a page on 22.
Wait for a bit.
And we get warnings which exposed detailed version information, right, about the SSA service on the
system, so that way we can learn the ports and services on the system.
OK, so I have an e-mail page in my Webroot directory.
And the content is like that because my attacking machine, Kelly, is also on the same network as BEBACK.
So I can include any page or resource from Kelly.
OK, and I'm going to paste this payload.
And you see, it works.
So it's a simple file inclusion.
But this time, the file is somewhere on the local network.
OK, so go back to terminal.
Under the evil folder, there are three text files prepared for SRF.
I'm just going to show you the first one.
So this code scans the network for these ports online, 28.
Then prints the result.
So we're going to use this file, so exit.
And open Firefox.
And we're going to use SRF one text like that.
And perform.
And it will perform a port scan on the target server box, but don't get confused.
This file is also in the B Web directory in PAYBOX, right.
However, I don't include it from there, I include it from Carly.
OK, so you can change the IP to another one in a local network.
And then you can scan it for these ports as well.
So type one two seven zero zero one.
Or type localhost.
And I can scan Kelly as well.
And look at that, only Apache is running on porteño.
I could also scan my host.
Wait just a bit for the results.
OK, so here's a real.
And I'll open these ports for this purpose and look what it discovers.
All right, so then go back to the SS R.F. Main Page.
All right, so the second vulnerability to request resources on the local network, I said, was x,
x, e s o go to Xixi one that BHP.
Then enable Foxe proxy.
And click here.
The request is in burb, so send the request to repeater and go to repeater.
Send the first request to check the connection.
All right, so we have seen the Xixi vulnerability.
So if you type something, it will reflect it to you.
OK, so instead of this XML data, I'm going to use this one.
So it requests the robot text file on V box, but I write the localhost.
So you can change this to any IP on the local network to read well and the other resources.
I'm going to stop here, but you can go ahead and continue because the rest is an xixi attack.
So please try and go as far as you can and to reverse in a local network.
I know you know how.