Server-side flaws: SSRF, XXE, JWT and defence
SSRF, XXE, JWT mistakes and upload security: how they happen and how to close them.
Level 301 · 15 lessons · 14 practice labs
Lessons
Requests made on the server’s behalf
- SSRF: requests made on the server's behalf: You will understand that SSRF means a server can be tricked into making requests to other addresses, and why that is dangerous.
- Against SSRF: allow-lists and network rules: You will limit the addresses a server may reach with allow-lists and network rules, and so close SSRF.
- Protecting the cloud metadata service: You will learn why the metadata service on cloud servers is sensitive and how to restrict access to it.
- Short task: find a URL-taking feature in the lab app and close it with an allow-list
Parsers and templates
- XML parsing risks (XXE) and closing them: You will understand the risk (XXE) that comes from XML parsers being able to read outside resources, and close it with safe settings.
- Template injection (SSTI): keeping user input out of templates: You will notice when user input is processed as code in a server template and close the gap by passing input only as data.
- Insecure deserialization: handling pickle and similar formats safely: You will understand why serialized data from outside is dangerous and move to a safer design using JSON and signature checks.
- Short task: pick one XML, template or deserialization flaw, evidence it and close it
Tokens and files
- JWT structure and correct validation: You will learn the three parts of a JWT, what the signature is for, and how a server should validate it correctly.
- JWT mistakes: unsigned tokens, weak keys: You will recognise and fix JWT mistakes such as accepting unsigned tokens or using weak keys, in code and settings.
- File upload security: You will make a file upload feature safe with checks on type, size, name and storage location.
- Short task: prove a JWT whose signature is not checked and fix the validation
The big picture
- Traces of server-side attacks: You will recognise the traces that SSRF, XML and file upload attacks leave in logs and think up alert rules for them.
- A short threat review for server-side risks
- Capstone: harden a service against server-side flaws: In the capstone you will harden a fictional company's service against SSRF, XML, JWT and upload risks and report the result.
Practice labs
- A link preview reaches an internal service: Prove the link preview feature sends requests to an internal admin service and add a domain allow list.
- Protect the cloud metadata service: Show the mock metadata endpoint in the lab is reachable through the app and close it with a network rule and a required session token.
- Internal network probing through a webhook feature: Show from response times that the webhook address can be used to probe internal ports and block it with egress rules.
- An external entity in an XML import: Prove the product import feature resolves external entities and turn off DTD processing in the parser.
- SSTI in an invitation email template: Prove the invitation text users can edit is rendered as a template and pass the text to the template as data.
- A preference carried with pickle in a cookie: Recognise that the preference cookie is serialised with pickle, show the risk with harmless proof and switch to signed JSON.
- Three parsers, one service: Find the flawed one in a reporting service that uses XML, templates and serialisation, close it and show with tests the other two are safe.
- A JWT whose signature is never checked: Prove the server does not check the JWT signature by changing the role and fix verification with the library's safe function.
- Verification that accepts alg none: Find the configuration that accepts unsigned tokens and pin the allowed algorithm.
- A weak JWT key: Detect in the lab a token signed with a dictionary word, replace the key with a strong random value and revoke the old tokens.
- An uploaded file runs on the server: Prove with a harmless file that the upload folder executes scripts, turn execution off and separate storage.
- An SSRF trace in the egress log: Find unexpected requests from the app server to internal addresses in the egress proxy log and match the triggering request in the web log.
- A quick threat review for server-side risks: List the inputs of a PDF generation service, assess SSRF, XXE and SSTI risks and close the highest one.
- Harden a service against server-side flaws: Close the SSRF, XXE and JWT weaknesses in the fictional Vendaro Invoicing service, add a detection rule for each and retest.
About this course
SSRF, XXE, JWT mistakes and upload security: how they happen and how to close them.
What you will learn
- Requests made on the server’s behalf
- Parsers and templates
- Tokens and files
- The big picture
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.