search

ine-labs / AWSGoat

AWSGoat : A Damn Vulnerable AWS Infrastructure
MIT License
1.7k stars 1.04k forks source link

05-Server Side Request Forgery Part 1 #5

Closed dev0x41 closed 2 years ago

dev0x41 commented 2 years ago

Seems the SSRF part 1 does not work as per the guide. The response is 'Invalid Authorization'. I think its expected this will be done using a self registered user, I don't see alternate credentials for this elsewhere or referred to in the guide. The error is the same trying to upload an image as in normal, non exploitation activity.

image

image

jeswinMathai commented 2 years ago

Thanks for pointing it out. Currently, the SSRF and other API-related attacks work once the web page is refreshed/reloaded.

We will release an update soon to patch the session issue.

jeswinMathai commented 2 years ago

The bug has been fixed with #12

stuartcompton commented 10 months ago

Hi @jeswinMathai.

I have installed the AWSGoat successfully and can login fine. I am working on the SSRF part 1, and tried to upload the payload file:///etc/passwd/. I get a 502 CORS Missing Allow Origin error everytime when trying to save to https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/v1/save-content?value=file:///etc/passwd/

Any ideas?

Many thanks