Detecting and Defending Against Server-Side Request Forgery - Seguridad Mania.com - España y América Latina

Today’s web applications help us stay connected and are more than likely dependent on other services. This means that most web applications will utilize a server that sends off HTTP requests in order to receive the information that drives its content and features. Server sent requests happen so often that we may not even notice that they are utilized. From chat clients that pull metadata when a user posts a video link, to webhooks that are fired after a repository change happens, servers are constantly requesting information from other resources. While these features may be useful, it is important to take extra care when crafting the server sent requests using user input. This presentation covers characteristics found in functionalities that are commonly susceptible to SSRF attacks. Furthermore, it demonstrates how it can be used to escalate privileges, and how it can breach user information confidentiality. Attend this webinar to examine these scenarios and discuss in-depth safe input handling techniques that defend against Server-Side Request Forgery.