Loren Norman lorennorman

SSRF & TOCTOU Attack Explainer

I learned something today and wanted to share.

There are ranges of IP addresses that mean special things, some refer to:

yourself (localhost)
other machines on your local network (like other computers you own inside the same datacenter)
special networking services (provided by AWS or whomever)

announcements and context (0-5min)

checkin (5min)

ideation (10min)

I hereby claim:

To claim this, I am signing this object:

	Connected!
	Added sub 0
	Added sub 1
	Added sub 2
	Added sub 3
	Connecting to Wippersnapper MQTT...Connecting to: io.adafruit.com
	Connect result: 1
	MQTT connect packet:
	[0x10], f [0x66], [0x00], [0x04], M [0x4D], Q [0x51], T [0x54], T [0x54],
	[0x04], [0xC2], [0x00], [0x05], [0x00], + [0x2B], i [0x69], o [0x6F],

	// Class Style
	import React from 'react';
	import PropTypes from 'prop-types';
	import { connect } from 'react-redux';
	import { createStructuredSelector } from 'reselect';
	import { compose } from 'redux';
	import injectReducer from 'utils/injectReducer';
	import injectSaga from 'utils/injectSaga';

	import reducer from './reducer';

	# Draws the Middleware stack as the request propogates in and out.
	module MiddlewareTracer
	def call(env)
	# request = ActionDispatch::Request.new(env)
	puts "-> #{self.class.name}:"
	status, headers, response = super(env)
	puts "<- #{self.class.name}, Status: #{status}"
	[status, headers, response]
	end
	end

	describe "Post Management", ->
	# eases visits and URL assertions
	pages
	posts: '/path/to/posts'
	post: '/path/to/posts/:id'

	# prepares for querying any elements you'll interact with
	elements
	submitButton: '.selector-for-submit'
	backButton: '.selector-for-back'