Navigating Blind SSRF: Attacking and Defending Critical Systems

The session opens with a red-team and blue-team pairing that explains how blind server-side request forgery differs from the ordinary kind. The vulnerable server fetches an attacker-chosen address but returns nothing visible, so results must be inferred through out-of-band callbacks, timing or error differences. The offensive half covers spotting URL-consuming parameters, testing them manually and with tooling, slipping past a web application firewall with encodings and IP-based hosts, and proving impact with an interaction server.

The defensive half treats blind SSRF as a standard input validation failure. It recommends secure-by-default Terraform modules, service mesh rules that limit east-west traffic, layered controls instead of relying on a WAF, and CI/CD pipelines that run static and dynamic scans. Detection ideas include requests to the cloud metadata address, DNS lookups from blocked requests, and SIEM baselines.

The closing case study follows a malicious PDF containing PostScript that was fetched through an SSRF and reached a serverless function, exposing its credentials and a bucket full of personal documents. Automated alerts on unusual credential use enabled containment within minutes. Takeaways include patching document-processing tools, sandboxing them, enforcing least-privilege IAM, and coordinating fixes between red and blue teams.