What security bug type keeps you awake?

Key Takeaways

So, there's a question I get asked quite a bit, which is what security bug today keeps me awake? [music] And I'm going to be honest, it's serverside request forgeries. Uh, this is a bug that wasn't even known about, say, a decadeish ago. Um, it was historically a web-based vulnerability. Um, but now with cloud environments across all clouds, it's actually a real serious problem. Um, and basically the problem is this. You take some input, there's another input validation problem for you and then that input is used to build a URL to access some data which normally would be say outside of the network. So the the web p the website may fetch a photograph for example. [music] Well, what happens if I can put the address of something on the internal network? Well, now the application goes and reaches inside the network, gets the data and gives it to the attacker. So serverside request forgeries are a really serious problem today. It is incredibly important that if you are building applications in any cloud environment, you understand about SSRFs.