Muhammad Asim Shahzad·6d agoThe SSRF That Mailed Out Your OAuth TokenA Google Cloud debugger bug shows why integrations must control where stored credentials are sent
Burrito·Nov 5The Bouncer Who Only Read IPv4: SSRF in WordPress Playground’s CORS ProxyAn errand-boy proxy, a split-personality hostname, and a delivery to the proxy’s own mailroom.A response icon1A response icon1
PRiTi.EX·Nov 3Lab6: Host validation bypass via connection state attackThe objective is to exploit incorrect Host header validation by reusing a previously validated HTTP connection to access the internal admin…
PRiTi.EX·Nov 2Lab5: SSRF via flawed request parsingIn this Lab it accepts the absolute URL instead of the Host header. To solve the lab follow me.
Arun Kumar Meenakshi Sundaram·Nov 2Understanding and Preventing SSRF in Spring Boot 4.1 with RestClientWhat is SSRF ?
Jegann·Oct 31localhost Is Blocked. But What About localhost.? 💀One tiny dot, one SSRF-protection bypass in Next.js @vercel/og. A story about hostname normalization and how a single trailing dot can slip…
Sahariarhasan·Oct 27I Bypassed a Whitelist-Based SSRF Filter PortSwigger Expert Lab WalkthroughI Bypassed a Whitelist-Based SSRF Filter — PortSwigger Expert Lab Walkthrough
InMeetCyberbyRaj Namdev·Oct 24Blind SSRF Isn’t Blind If You Build the Channel BackIt’s not the request you fire. It’s whether the response comes home.
Nitin yadav·Oct 20The Bug Hiding In A Feature Nobody Uses AnymoreEveryone tests the login page. The finding was in a publishing interface from 2005 that the site owner did not know existed.
