Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
okla.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Oklahoma... we're trying ya'll

Administered by:

Server stats:

33
active users

okla.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#ssrf

2 posts2 participants0 posts today
securityaffairs<p>Experts warn of a coordinated surge" in the exploitation attempts of <a href="https://infosec.exchange/tags/SSRF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SSRF</span></a> flaws<br><a href="https://securityaffairs.com/175344/hacking/coordinated-surge-exploitation-attempts-ssrf-vulnerabities.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/175344/hac</span><span class="invisible">king/coordinated-surge-exploitation-attempts-ssrf-vulnerabities.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hacking</span></a></p>
0x40k<p>Alright folks, gotta share something kinda alarming I just read: SSRF attacks are seriously picking up steam! 🤯 For those who don't know, SSRF (Server Side Request Forgery) is nasty business. Basically, attackers can trick your server into making requests *for* them. Think internal network snooping, stealing cloud credentials... you know the drill.</p><p>And get this – it's hitting tons of systems at once (DotNetNuke, Zimbra, VMware, GitLab, Ivanti, you name it!). It almost feels like a coordinated attack, doesn't it?</p><p>It's especially dicey in the cloud because SSRF can be used to access internal metadata APIs. Yikes!</p><p>I'm telling you, I once did a pentest where we almost completely missed an SSRF vulnerability being used to compromise internal AWS resources. It was a super close call! 😅</p><p>So, here's what you should do, pronto:</p><p>* **Patch like your life depends on it!** (Seriously, this isn't optional)<br>* **Restrict outgoing connections** (Least Privilege is your best friend here!)<br>* **Monitor those outgoing requests** (Gotta catch any suspicious behavior)<br>* **Network segmentation** (This can seriously limit the damage)</p><p>AI can be helpful for spotting anomalies, but remember: AI is NOT a pentest! Automated scans are nice, but they're no replacement for actual human expertise.</p><p>Are you seeing more SSRF attacks lately? What tools are you using to detect them? Let me know in the comments.</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/ssrf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ssrf</span></a> <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pentest</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/cloudsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cloudsecurity</span></a></p>
ExploreLive feeds
About