Server-Side Request Forgery (SSRF) Explained

Рет қаралды 22,246

Жыл бұрын

Purchase my Bug Bounty Course here 👉🏼 bugbounty.nahamsec.training
Buy Me Coffee:
www.buymeacoffee.com/nahamsec
Live Every Sunday on Twitch:
/ nahamsec
Free $100 DigitalOcean Credit:
m.do.co/c/3236319b9d0b
Follow me on social media:
/ nahamsec
/ nahamsec
twitch.com/nahamsec
hackerone.com/nahamsec
/ nahamsec1
Github:
github.com/nahamsec
Nahamsec's Discord:
discordapp.com/invite/ucCz7uh
#offensivesecurity #redteam #bugbounty #hackerone #hackers #hacking #infosec #hackingtutorial #owasp #educational

Пікірлер: 98

@francoischaer Жыл бұрын

hey Ben, we surely already love your content, but, for those like me, who are new to the industry, trying to learn and move forward, we need the technical, very basic content, this will help us understand more in depth how things goes. thank you again for the great content you are delivering, and for the amount of dedication you are putting in

@bashiqali2142 Жыл бұрын

Content + real vulnerability example would be great 🔥

@citywitt3202 7 ай бұрын

As CEO of a startup please keep this stuff coming. It took a lot to convince the dev team that exploits weren’t just down to weak passwords so I arranged an in house demo. Jaws dropped. This stuff builds so much awareness. Thank you!

@irfankhalid3122 Жыл бұрын

Never thought I could learn SSRF in a more comprehensive way by under 15 minutes! Thanks man!

@NahamSec Жыл бұрын

Thanks! I'm glad it helped!

@BlancoBox 7 ай бұрын

While I may not have commented before, I've been an avid admirer of your work. As an aspiring pentester, I find your technical content to be precisely what I seek. While your other content is commendable, it's ultimately the expertise you bring that I look up to for learning. Your contributions are truly appreciated.

@baraamansi7637 Жыл бұрын

OFC it would be truly helpful to see more content like this

@shiewhun1772 Жыл бұрын

Yes, this is great. From a web developer perspective. I'm trying to under how my server side applications could be hacked and this is great content. Please, continue.

@sveneFX Жыл бұрын

Fully in with technical vids, especially when you chain these with Real life vulns you have found 👌

@vaibhavsangwan996 Жыл бұрын

Hey I absolutely love this, I would love to learn from more technical videos like this.

@rllan006 Жыл бұрын

100% both. I like the nuance you teach here. For example login page and SSRF. This is fantastic content.

@janekmachnicki2593 9 ай бұрын

Content + real+technical aspect of pen testing and bug hunting .Thanks

@user-yq1ov8re3s 5 ай бұрын

More content is needed like this along with real life examples that you experienced during bug bounty or other testing application

@billelghezal7855 Жыл бұрын

Thank you very much, I hope you'll continue doing these kind of videos 😊

@JPwnage Жыл бұрын

Man, keep both coming.!! maybe pick a day to post technical and assign another day for the mentorship aspects or something... Either way ... BOTH ARE EQUALLY IMPORTANT FOR SUCCESS!! ...Also i would love a video on how to transfer from labs /ctf into hacking real world apps. As the fundamentals are the same or close but also very different in alot of ways.

@supritpandurangi5647 Жыл бұрын

Waiting for this type of content ; please Continue Ben :)

@ss-rc1gy Жыл бұрын

fantastic :o , i would like to see a full and advanced recon video from you :)

@Free.Education786 Жыл бұрын

Please, if possible, cover these advanced topics like How to bypass Drupal CMS or other secured CMS? How to bypass HARD WAF protection that stops HTML, SQL, and XSS injection payloads? Payload single-double-triple encoding using Cyber-Chef? How to find the real origin IP of secured websites behind Cloudflare, Akamai, ModSecurity, AWS CDN, etc.,? How to bypass Hard WAF using SQLMAP or Burpsuite? How to find hidden vulnerable parameters and endpoints inside the .js and .jason files? How to find hidden admin pages, cPanel pages, and WHM pages ? Please cover these important topics. Thanks

@long2330 Жыл бұрын

Thanks for helpful content! It would be great if u could do more specific showcases about blind SSRF. For example there is a case that I only receive the DNS queries back to the collab. I guess because of outbound restriction but it seems like the server was trying to reach to that domain. Any way in this case that you can prove the ssrf is there with just DNS? Or do you have any suggestion on setting up things in internal network to prove the vulnerability is there? Was a long comment but hope u could imagine the case 😂 thanks

@user-ie1hp3el3m 10 ай бұрын

Hi man, I would like to hear you how to do bug bounties exactly and maybe if you can show on live all the necessary steps to do it

@yourinatestrn3436 Жыл бұрын

Yea would love this type of content plz part 2

@ethyhack Жыл бұрын

yes please, give us more content of this kind.

@GrimComix Жыл бұрын

Yes, more content like this please 😁

@lovedaysmart9183 Жыл бұрын

Just what we need Ben 😊 thank you 👏🏻

@3N18AKPzmGOsBgWKH Жыл бұрын

Haya! I have quite a lot of experience in pentesting webapps, but i do not have any experience in hosting an instance of a webserver, securing it or being able to load an insecure server, but in a secure way cause we don't want a creepy scanner rooting it and being malicious when i want to test it :P So my question, could you make a lill tutorial in how to, for example, use a docker or maybe host a site in different means through a Digital Ocean instance? :P Would be fun to learn a little bit about it and then being able to pentest towards it. By learning this, one can use your knowledge to host a file hosting instance to make an RFI etc, which is a bit difficult without an outwards facing host ^^ Stay safe and happy late Easter!

@augustvansickle1 Жыл бұрын

Would love to see more technical content! TIA

@The_capitol Жыл бұрын

I would like to see one of the vulnerabilities you have found and walk through the info gathering stage all the way to the post exploit while explaining the mindset/methodology

@NahamSec Жыл бұрын

Soon :)

@volatileobj3cts Жыл бұрын

Super down with more technical content!

@vibhavtiwari7260 Жыл бұрын

we need more part of this

@andrewsan2998 Жыл бұрын

East or West, naham is the best.

@BulbulBigbossbd Жыл бұрын

Hi NahamSec, I'm a regular viewer of your content.can you make video on business logic in dept!! waiting for it

@amoh96 11 ай бұрын

We really want this explain bugs for beginners and give us some advice about the bug i really wish u make playlist for this !! thank u alot

@ogbooker4538 Жыл бұрын

both content is fine and some free tutorials

@zak6820 Жыл бұрын

Yes more content like this pls

@bugs-lk3jf 11 ай бұрын

Great Content; More Please 🤑

@ogbooker4538 Жыл бұрын

stay consistent big bro

@heli_9 Жыл бұрын

I’d love more technical videos

@jeremyg737 Жыл бұрын

part 2? more content like this!

@onsiyammalembe1546 Жыл бұрын

I love this content make more please

@SecurityVaultYT Жыл бұрын

Epic, Part 2 please.

@tehlan6340 Жыл бұрын

You are great bro

@devanshuthanvi731 Жыл бұрын

Perfect type of content 😃👍

@firosiam7786 Жыл бұрын

Is Bola and idor the same type of vulnerability with different names

@dtchallohfranc3360 11 ай бұрын

Part 2 please 😍

@rafekhen4263 Ай бұрын

More content

@weniweedeewiki.6237 Жыл бұрын

PART 2 BRO DEFO

@Asadneon 3 ай бұрын

web hacking content more please

@drive8263 Жыл бұрын

Both....

@raghvendrachouhan3433 10 ай бұрын

theory is all good but when it comes to practical i'm hopeless.

@husamgameel1489 Жыл бұрын

yup yup more tutorials for hacking and IT stuff how to do ore bypass

@ZarakKhanNiazi Жыл бұрын

I love you naham

@NahamSec Жыл бұрын

@SalimShaikh-ip7gi Жыл бұрын

Part2

@0xbeven462 Жыл бұрын

I reported my browser 😂

@entertainment_in_blood 8 ай бұрын

PART-2

@srcybersec1736 Жыл бұрын

Want more vdo

@navidof5 Жыл бұрын

part 2

@user-bs1ju9yt5m Жыл бұрын

Part 2 ,,4,5,6,7,8,9,-----,99999

@mahdihasan42 Жыл бұрын

location hack

@Haxr-dq6wt 11 ай бұрын

Bad explanation with a lot or wrong info

@tehlan6340 Жыл бұрын

I make hacking videos

@handle_my_handle Жыл бұрын

Part 2

@yourmove9993 Жыл бұрын

part 2

@JD-wj1bf 10 ай бұрын

Part 2