This lesson covers two vulnerabilities that share a single root cause: the server acts on a value supplied by the client without inspecting it.
Scope reminder: perform upload and SSRF testing only against systems you own or are explicitly authorized to test. The bundled NovaCart application instance is the authorized lab target for this lesson.
- Server-Side Request Forgery (SSRF) is the case where the client-supplied value is a URL, and the server fetches it.
- Unrestricted File Upload is the case where the client-supplied value is a file, and the server stores it.
In this lesson you will:
- Use NovaCart's complaint form to attempt an upload of a non-PDF file, illustrating how an extension allowlist constrains uploads.
- Attempt an oversized upload to illustrate the need for a server-side size limit independent of any reverse proxy.
- Reason about what SSRF lets an attacker reach on a cloud-hosted application, and identify the addresses an SSRF attacker probes first.
Estimated time: fifteen to twenty minutes.
Prerequisites: http-fundamentals for request anatomy, browser-recon for the Network tab, networking-fundamentals-part1 for IP address ranges and the concept of private networks (needed for the SSRF half of this lesson), and a normal NovaCart user account. The complaint form is reachable from the user menu after login, or directly at /vuln/nebula-complain.
When you are ready, send the Continue signal.