CSRF, SSRF & Open Redirect

Forged requests, server-side request forgery and unsafe redirects.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

5/5

1. 00:00CSRF, SSRF & Open Redirect. Forged requests, server-side request forgery and unsafe redirects.
2. 00:05CSRF tricks a logged-in victim's browser into sending a state-changing request.
3. 00:10SSRF tricks the server into making a request on the attacker's behalf - often to internal services the attacker cannot reach.
4. 00:18Reference table: Bug, Defence.
5. 00:23Note: SSRF against cloud metadata services can expose instance credentials - treat any user-supplied URL that the server fetches as high risk.

CSRF tricks a logged-in victim's browser into sending a state-changing request. SSRF tricks the server into making a request on the attacker's behalf - often to internal services the attacker cannot reach.