Class: Aikido::Zen::Attacks::StoredSSRFAttack

Inherits:
Aikido::Zen::Attack show all
Defined in:
lib/aikido/zen/attack.rb

Overview

Special case of an SSRF attack where we don’t have a context—we’re just detecting a request to a particularly sensitive address.

Instance Attribute Summary collapse

Attributes inherited from Aikido::Zen::Attack

#context, #operation, #sink

Instance Method Summary collapse

Methods inherited from Aikido::Zen::Attack

#blocked?, #will_be_blocked!

Constructor Details

#initialize(hostname:, address:, **opts) ⇒ StoredSSRFAttack

Returns a new instance of StoredSSRFAttack.



112
113
114
115
116
 
# File 'lib/aikido/zen/attack.rb', line 112

def initialize(hostname:, address:, **opts)
  super(**opts)
  @hostname = hostname
  @address = address
end

Instance Attribute Details

#address ⇒ Object (readonly)

Returns the value of attribute address.



110
111
112
 
# File 'lib/aikido/zen/attack.rb', line 110

def address
  @address
end

#hostname ⇒ Object (readonly)

Returns the value of attribute hostname.



109
110
111
 
# File 'lib/aikido/zen/attack.rb', line 109

def hostname
  @hostname
end

Instance Method Details

#as_json ⇒ Object 



129
130
131
132
133
134
135
 
# File 'lib/aikido/zen/attack.rb', line 129

def as_json
  {
    kind: "ssrf",
    blocked: blocked?,
    operation: @operation
  }
end

#exception ⇒ Object 



125
126
127
 
# File 'lib/aikido/zen/attack.rb', line 125

def exception(*)
  SSRFDetectedError.new(self)
end

#log_message ⇒ Object 



118
119
120
121
122
123
 
# File 'lib/aikido/zen/attack.rb', line 118

def log_message
  format(
    "Stored SSRF: Request to sensitive host «%s» (%s) detected from unknown source in %s",
    @hostname, @address, @operation
  )
end