prikaz prve stranice dokumenta Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)
  Download
PDF 795.9 KB
master's thesis
Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)
Zagreb: University of Zagreb, Faculty of Science, 2022. urn:nbn:hr:217:821110
Valentić, Lucija
University of Zagreb
Faculty of Science
Department of Mathematics

Institutional repository: Repository of the Faculty of Science

Cite this document

Valentić, L. (2022). Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery) (Master's thesis). Zagreb: University of Zagreb, Faculty of Science. Retrieved from https://urn.nsk.hr/urn:nbn:hr:217:821110

Valentić, Lucija. "Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)." Master's thesis, University of Zagreb, Faculty of Science, 2022. https://urn.nsk.hr/urn:nbn:hr:217:821110

Valentić, Lucija. "Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)." Master's thesis, University of Zagreb, Faculty of Science, 2022. https://urn.nsk.hr/urn:nbn:hr:217:821110

Valentić, L. (2022). 'Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)', Master's thesis, University of Zagreb, Faculty of Science, accessed 26 November 2024, https://urn.nsk.hr/urn:nbn:hr:217:821110

Valentić L. Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery) [Master's thesis]. Zagreb: University of Zagreb, Faculty of Science; 2022 [cited 2024 November 26] Available at: https://urn.nsk.hr/urn:nbn:hr:217:821110

L. Valentić, "Kibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)", Master's thesis, University of Zagreb, Faculty of Science, Zagreb, 2022. Available at: https://urn.nsk.hr/urn:nbn:hr:217:821110

Metadata
TitleKibernetička sigurnost i ranjivosti: SSRF (Server-side Request Forgery)
Title (english)Cyber security and vulnerabilities: SSRF (Server-side Request Forgery)
AuthorLucija Valentić
MentorGoran Igaly (mentor)
Committee memberGoran Igaly (predsjednik povjerenstva)
Committee memberFranka Miriam Brückler (član povjerenstva)
Committee memberOzren Perše (član povjerenstva)
Committee memberMiljenko Marušić (član povjerenstva)
GranterUniversity of Zagreb
Faculty of Science
(Department of Mathematics)
Zagreb
Defense date and country2022-09-27, Croatia
Scientific / art field,
discipline and subdiscipline		NATURAL SCIENCES
Mathematics
Abstract
SSRF je kibernetička ranjivost gdje zlonamjerni korisnik uspije “natjerati” ranjivu aplikaciju ili poslužitelj da napravi proizvoljan zahtjev prema nekoj proizvoljnoj lokaciji. Sama SSRF ranjivost ne mora biti opasna, ali njezinim iskorištavanjem se mogu potencijalno iskoristiti i neke druge ranjivosti koje jesu opasne. Iskorištavanjem SSRF ranjivosti se može doći do osjetljivih podataka, kontaktirati poslužitelje ili usluge unutar interne mreže koji nisu dostupni izvana, ili se nakon nje mogu iskoristiti i neke druge ranjivosti, te je moguće čak dobiti pristup poslužitelju i izvršavati kod iz daljine (RCE). Postoji više načina na koji se može aplikacija zaštititi od SSRF-a. Pažljivim programiranjem i korištenjem recimo kombinacije bijele liste i crne liste, te korištenjem vatrozida, može se smanjiti mogućnost da je aplikacija ranjiva na SSRF ranjivost. OWASP je 2021. godine uvrstio SSRF na svoj popis Top Ten Web Application Security Risks. Kao što i sam naziv govori, popis sadrži ranjivosti koje su bile najkritičnije te godine po mišljenjima stručnjaka.
Abstract (english)
SSRF is a cybersecurity vulnerability where malicous user forces an application or server to make a request to arbitrary location. SSRF vulnerability is not dangerous by itself, but chained with other vulnerabilites it can create very dangerous exploit-chain that can lead to exploatation of the application. Abusing SSRF vulnerability, an attacker can extract sensitive information (like passwords), contact servers or services that are not available from the outside, or, SSRF vulnerability can be used to perform other very dangerous attacks, such as Remote Code Execution (RCE). There are many ways to combat this vulnerability. Using good programming practices and maybe combining whitelist, blacklist and firewall, application can be made more safe from this kind of vulnerability at least. OWASP added SSRF vulnerability to their top ten list named Top Ten Web Application Security Risks. As it can be deducted from the name, the list consists of the most critical vulnerability that year based on consensus of experts.
Keywords
Keywords (english)
Languagecroatian
URN:NBNurn:nbn:hr:217:821110
Study programmeTitle: Computer Science and Mathematics
Study programme type: university
Study level: graduate
Academic / professional title: magistar/magistra računarstva i matematike (magistar/magistra računarstva i matematike)
Type of resourceText
File originBorn digital
Access conditionsOpen access
Terms of useLicence In copyright icon
Created on2022-11-09 13:00:09