CWE knowledge base | ImmuniWeb

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

谈吐大方的啤酒 · UnicodeDecodeError ...· 1 周前 ·

风流倜傥的山寨机 · ReferenceError: ...· 1 周前 ·

好帅的野马 · Testing activity in ...· 昨天 ·

性感的仙人掌 · Jest Testing like a ...· 14 小时前 ·

骑白马的沙滩裤 · 开封市祥符区实验中学_百度百科· 2 月前 ·

不爱学习的火车 · 定安印象 -- 定安文化 -- 定安县人民政府· 5 月前 ·

冲动的登山鞋 · Xcode automatically ...· 5 月前 ·

气宇轩昂的鼠标垫 · 关注寒门学子 ...· 5 月前 ·

谦虚好学的长颈鹿 · GitHub - ...· 5 月前 ·

</noscript> <div class="mobile-header"> <div class="headermobile"> <a class="logo-link" href="https://www.immuniweb.com/"> <img src="/images/logo-immuniweb.svg" alt="ImmuniWeb - Web and Mobile Application Security" title="ImmuniWeb - Web and Mobile Application Security" width="226" height="52"/> </a> </div> <div class="page-progress"><progress value="0" max="100"/></div> <nav role="navigation"> <div id="menuToggle"> <input type="checkbox" class="navigation-close"/> <span/> <span/> <span/> <ul id="menus"> <li> <div class="wrapper-menus"> <div class="menu-btns" id="login_block"> <div id="free_demo_top" class="button-demorequest" onclick="window.open('/technology/demo/', '_self')">Demo</div> <div id="free_demo_top" class="button-demorequest" onclick="window.open('/technology/demo/', '_self')" style="margin-left: 20px;background: #59a7ff;border: 1px solid #59a7ff;">Pricing</div> </div> <div class="clearer"/> <input id="immuniweb" type="checkbox"/> <label for="immuniweb"> <p>ImmuniWeb® AI Platform</p> <div class="lil_arrow"/> <div class="content-navi"> <ul> <li><a href="/use-cases/api-penetration-testing/" data-id="api-penetration-testing"><img src="/images/use-cases/white/api-penetration-testing.svg" width="22" height="22"/>API Penetration Testing</a></li> <li><a href="/use-cases/api-security-scanning/" data-id="api-security-scanning"><img src="/images/use-cases/white/api-security-scanning.svg" width="22" height="22"/>API Security Scanning</a></li> <li><a href="/use-cases/attack-surface-management/" data-id="attack-surface-management-and-asset-discovery"><img src="/images/use-cases/white/attack-surface-management.svg" width="22" height="22"/>Attack Surface Management</a></li> <li><a href="/use-cases/cyber-threat-intelligence/" data-id="cyber-threat-intelligence"><img src="/images/use-cases/white/cyber-threat-intelligence.svg" width="22" height="22"/>Cyber Threat Intelligence</a></li> <li><a href="/use-cases/dark-web-monitoring/" data-id="dark-web-monitoring"><img src="/images/use-cases/white/dark-web-monitoring.svg" width="22" height="22"/>Dark Web Monitoring</a></li> <li><a href="/use-cases/digital-brand-protection/" data-id="digital-brand-protection"><img src="/images/use-cases/white/digital-brand-protection.svg" width="22" height="22"/>Digital Brand Protection</a></li> <li><a href="/use-cases/mobile-penetration-testing/" data-id="mobile-penetration-testing"><img src="/images/use-cases/white/mobile-penetration-testing.svg" width="22" height="22"/>Mobile Penetration Testing</a></li> <li><a href="/use-cases/phishing-websites-takedown/" data-id="phishing-websites-takedown"><img src="/images/use-cases/white/phishing-websites-takedown.svg" width="22" height="22"/>Phishing Websites Takedown</a></li> <li><a href="/use-cases/web-penetration-testing/" data-id="web-penetration-testing"><img src="/images/use-cases/white/web-penetration-testing.svg" width="22" height="22"/>Web Penetration Testing</a></li> <li><a href="/use-cases/web-security-scanning/" data-id="web-security-scanning"><img src="/images/use-cases/white/web-security-scanning.svg" width="22" height="22"/>Web Security Scanning</a></li> <li><a href="/presentation/" style="display: block; width: auto; float: left;">PDF Presentation</a><a href="/use-cases/" style="display: block; width: auto; float: right;">See All [20]</a></li> </ul> </div> <span/> </label> <input id="company" type="checkbox"/> <label for="company"> <p>Company</p> <div class="lil_arrow"/><div class="content-navi"> <ul> <li><a href="/company/leadership/">History and Leadership</a></li> <li><a href="/company/awards/">Awards and Recognition</a></li> <li><a href="/get-certified/">ImmuniWeb® Certified Professional</a></li> <li><a href="/customers/">Customer Success</a></li> <li><a href="/company/contacts/">Contacts</a></li> <li><a href="/company/careers/">Careers</a></li> </ul> </div> <span/> </label> <input id="newsmenu" type="checkbox"/> <label for="newsmenu"> <p>News &amp; Events</p> <div class="lil_arrow"/><div class="content-navi"> <ul> <li><a href="/blog/">Cyber Law Blog</a></li> <li><a href="/news/">News and Press Releases</a></li> <li><a href="/media/">International Media Coverage</a></li> <li><a href="/webinars/">Webinars</a></li> <li><a href="/events/">Events</a></li> <li><a href="/resources/">Resources</a></li> </ul> </div> <span/> </label> <input id="partners" type="checkbox"/> <label for="partners"> <p>Partners</p> <div class="lil_arrow"/><div class="content-navi"> <ul> <li><a href="/partners/">Partner Program</a></li> <li><a href="/partners/#apply-form">Become a Partner</a></li> <li><a href="/partners/directory/">Partner Directory</a></li> <li><a href="/integrations/">Integrations</a></li> </ul> </div> <span/> </label> <input id="free" type="checkbox"/> <label for="free"> <p>Community Edition </p> <div class="lil_arrow"/><div class="content-navi"> <ul> <li><a href="/cloud/">Cloud Security Test</a></li> <li><a href="/email/">Email Security Test</a></li> <li><a href="/websec/">Website Security Test</a></li> <li><a href="/mobile/">Mobile App Security Test</a></li> <li><a href="/darkweb/">Dark Web Exposure Test</a></li> <li><a href="/ssl/">SSL Security Test</a></li> </ul> </div> <span/> </label> <label for="compliance_link"> <p class="menu-immuniweb-link"><a href="/compliance/">Compliance</a></p> </label> </div> <div class="menu_social_networks"> <a target="_blank" href="https://www.linkedin.com/company/immuniweb" rel="nofollow"><img src="/i2/mobile-images/linkedin.svg" alt="ImmuniWeb on LinkedIn"/></a> <a target="_blank" href="https://twitter.com/immuniweb"><img src="/i2/mobile-images/twitter.svg" alt="ImmuniWeb on Twitter"/></a> <a target="_blank" href="https://chat.whatsapp.com/BtUTr8htygk3LJph2dFiQ2"><img src="/images/social/bottom/whatsapp.svg" alt="ImmuniWeb on WhatsApp"/></a> <a target="_blank" href="https://t.me/immuniweb_ai"><img src="/images/social/bottom/telegram.svg" alt="ImmuniWeb on Telegram"/></a> <a target="_blank" href="https://www.facebook.com/immuniweb"><img src="/i2/mobile-images/facebook.svg" alt="ImmuniWeb on Facebook"/></a> <a target="_blank" href="https://www.youtube.com/ImmuniWeb"><img src="/i2/mobile-images/youtube.svg" alt="ImmuniWeb on YouTube"/></a> <a href="/subscriptions/"><img src="/i2/mobile-images/email-newsletter.svg" alt="ImmuniWeb RSS"/></a> </div> </li> </ul> </div> </nav> </div> <div class="renew-line"> <div class="renew-line__content"> <p id="top_line" class="renew-line__description"/> <button class="renew-line__close" onclick="kickRenewLine()"> <svg xmlns="http://www.w3.org/2000/svg" height="24" viewbox="0 0 24 24" width="24"> <path fill="currentColor" d="M19 6.41L17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/> </svg> </button> </div> </div> <div id="smallmessagediv"/> <div class="breadcrumbs" id="toph1"><a href="/">ImmuniWeb</a> &gt; <a href="/vulnerability/">CWE Knowledge Base</a> &gt; <span class="current">Server-Side Request Forgery [CWE-918]</span></div><style type="text/css"> table.vuln { border:1px solid #808080; border-collapse:collapse; } table.vuln td, table.vuln th { padding:5px; border:1px solid #808080; } table.vuln th, table.vuln td.b { font-weight: bold; } .right_content h3 { font-size: 25px; margin: 30px 0 20px 0; } h4 { margin: 15px 0 10px 0; } .right_content h5 { color: #67abe2; font-size: 16px; } .right_content ul { padding-bottom:0; } ul li { list-style-image:none; text-align: left; } ol li { list-style:decimal; text-align: left; } ul.advisorylist li { list-style-image:url("/images/li-icon.png"); } ul.lowalpha { list-style:lower-alpha; } ul.decimal li { list-style:decimal; } ul.disc li { list-style:disc; } ul.disc li { list-style:disc; } ul.disc li, ul.lowalpha li { list-style-image:none; } code { font-family: monospace; font-size: 12px; font-style: normal; font-weight: normal; } .cvss2 { color:#688BB3; } .code-block { display:block; background-color: #F9F9F9; border: 1px dashed #C1C1C1; padding:5px; } code, .php, .perl, .html4strict, .apache, .mysql, .asp, .python, .java, .c, .cpp, .xml { margin: 5px 0 15px 0; text-align:left; } .php .de1, .php .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000; margin: 0 0 0 -7px; position: relative; background: #ffffff;} .php { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .php ol, .php ol li { list-style:none; } .php .imp {font-weight: bold; color: red;} .php li, .php .li1 {background: #fff; margin:0; } .php .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .php .kw1 {color: #b1b100;} .php .kw2 {color: #000000; font-weight: bold;} .php .kw3 {color: #990000;} .php .kw4 {color: #009900; font-weight: bold;} .php .co1 {color: #666666; font-style: italic;} .php .co2 {color: #666666; font-style: italic;} .php .co3 {color: #0000cc; font-style: italic;} .php .co4 {color: #009933; font-style: italic;} .php .coMULTI {color: #666666; font-style: italic;} .php .es0 {color: #000099; font-weight: bold;} .php .es1 {color: #000099; font-weight: bold;} .php .es2 {color: #660099; font-weight: bold;} .php .es3 {color: #660099; font-weight: bold;} .php .es4 {color: #006699; font-weight: bold;} .php .es5 {color: #006699; font-weight: bold; font-style: italic;} .php .es6 {color: #009933; font-weight: bold;} .php .es_h {color: #000099; font-weight: bold;} .php .br0 {color: #009900;} .php .sy0 {color: #339933;} .php .sy1 {color: #000000; font-weight: bold;} .php .st0 {color: #0000ff;} .php .st_h {color: #0000ff;} .php .nu0 {color: #cc66cc;} .php .nu8 {color: #208080;} .php .nu12 {color: #208080;} .php .nu19 {color:#800080;} .php .me1 {color: #004000;} .php .me2 {color: #004000;} .php .re0 {color: #000088;} .php .ln-xtra, .php li.ln-xtra, .php div.ln-xtra {color:black;background:#FFFF88;} .php span.xtra { display:block; } .perl .de1, .perl .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000; margin: 0 0 0 -7px; position: relative; background: #ffffff;} .perl { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .perl ol, .perl ol li { list-style:none; } .perl .imp {font-weight: bold; color: red;} .perl li, .perl .li1 {background: #fff; margin:0; } .perl .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .perl .kw1 {color: #b1b100;} .perl .kw2 {color: #000000; font-weight: bold;} .perl .kw3 {color: #000066;} .perl .co1 {color: #666666; font-style: italic;} .perl .co2 {color: #009966; font-style: italic;} .perl .co3 {color: #0000ff;} .perl .co4 {color: #cc0000; font-style: italic;} .perl .co5 {color: #0000ff;} .perl .coMULTI {color: #666666; font-style: italic;} .perl .es0 {color: #000099; font-weight: bold;} .perl .es_h {color: #000099; font-weight: bold;} .perl .br0 {color: #009900;} .perl .sy0 {color: #339933;} .perl .st0 {color: #ff0000;} .perl .st_h {color: #ff0000;} .perl .nu0 {color: #cc66cc;} .perl .me1 {color: #006600;} .perl .me2 {color: #006600;} .perl .re0 {color: #0000ff;} .perl .re4 {color: #009999;} .perl .ln-xtra, .perl li.ln-xtra, .perl div.ln-xtra {color:black;background:#FFFF88;} .perl span.xtra { display:block; } .html4strict .de1, .html4strict .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .html4strict { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .html4strict ol, .html4strict ol li { list-style:none; } .html4strict .imp {font-weight: bold; color: red;} .html4strict li, .html4strict .li1 {background: #fff; margin:0;} .html4strict .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .html4strict .kw2 {color: #0000FF; } .html4strict .kw3 {color: #000066;} .html4strict .es0 {color: #000099; font-weight: bold;} .html4strict .br0 {color: #66cc66;} .html4strict .sy0 {color: #66cc66;} .html4strict .st0 {color: #ff0000;} .html4strict .nu0 {color: #cc66cc;} .html4strict .sc-2 {color: #404040;} .html4strict .sc-1 {color: #808080; font-style: italic;} .html4strict .sc0 {color: #00bbdd;} .html4strict .sc1 {color: #ddbb00;} .html4strict .sc2 {color: #009900;} .html4strict .ln-xtra, .html4strict li.ln-xtra, .html4strict div.ln-xtra {color:black;background:#FFFF88;} .html4strict span.xtra { display:block; } .apache .de1, .apache .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .apache { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .apache .imp {font-weight: bold; color: red;} .apache li, .apache .li1 {background: #fff; margin:0; list-style:none; } .apache .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .apache .kw1 {color: #00007f;} .apache .kw2 {color: #0000ff;} .apache .kw3 {color: #000000; font-weight:bold;} .apache .co1 {color: #adadad; font-style: italic;} .apache .es0 {color: #000099; font-weight: bold;} .apache .st0 {color: #7f007f;} .apache .nu0 {color: #ff0000;} .apache .ln-xtra, .apache li.ln-xtra, .apache div.ln-xtra {color:black;background:#FFFF88;} .apache span.xtra { display:block; } .mysql .de1, .mysql .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .mysql { color:#ACACAC; padding:5px;background-color: #F9F9F9; border: 1px dashed #C1C1C1;} .mysql .imp {font-weight: bold; color: red;} .mysql li, .mysql .li1 {background: #fff;list-style:none;margin:0;} .mysql .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .mysql .kw1 {color: #990099; font-weight: bold;} .mysql .kw2 {color: #990099; font-weight: bold;} .mysql .kw3 {color: #9900FF; font-weight: bold;} .mysql .kw4 {color: #999900; font-weight: bold;} .mysql .kw5 {color: #999900; font-weight: bold;} .mysql .kw6 {color: #FF9900; font-weight: bold;} .mysql .kw7 {color: #FF9900; font-weight: bold;} .mysql .kw8 {color: #9900FF; font-weight: bold;} .mysql .kw9 {color: #9900FF; font-weight: bold;} .mysql .kw10 {color: #CC0099; font-weight: bold;} .mysql .kw11 {color: #CC0099; font-weight: bold;} .mysql .kw12 {color: #009900;} .mysql .kw13 {color: #000099;} .mysql .kw14 {color: #000099;} .mysql .kw15 {color: #000099;} .mysql .kw16 {color: #000099;} .mysql .kw17 {color: #000099;} .mysql .kw18 {color: #000099;} .mysql .kw19 {color: #000099;} .mysql .kw20 {color: #000099;} .mysql .kw21 {color: #000099;} .mysql .kw22 {color: #000099;} .mysql .kw23 {color: #000099;} .mysql .kw24 {color: #000099;} .mysql .kw25 {color: #000099;} .mysql .kw26 {color: #000099;} .mysql .kw27 {color: #00CC00;} .mysql .coMULTI {color: #808000; font-style: italic;} .mysql .co1 {color: #808080; font-style: italic;} .mysql .co2 {color: #808080; font-style: italic;} .mysql .es0 {color: #004000; font-weight: bold;} .mysql .es1 {color: #008080; font-weight: bold;} .mysql .br0 {color: #FF00FF;} .mysql .sy1 {color: #CC0099;} .mysql .sy2 {color: #000033;} .mysql .st0 {color: #008000;} .mysql .nu0 {color: #008080;} .mysql .ln-xtra, .mysql li.ln-xtra, .mysql div.ln-xtra {color:black;background:#FFFF88;} .mysql span.xtra { display:block; } .asp .de1, .asp .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .asp { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .asp .imp {font-weight: bold; color: red;} .asp li, .asp .li1 {background: #fff;list-style:none;margin:0;} .asp .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .asp .kw1 {color: #990099; font-weight: bold;} .asp .kw2 {color: #0000ff; font-weight: bold;} .asp .kw3 {color: #330066;} .asp .co1 {color: #008000;} .asp .co2 {color: #ff6600;} .asp .coMULTI {color: #008000;} .asp .es0 {color: #000099; font-weight: bold;} .asp .br0 {color: #006600; font-weight:bold;} .asp .sy0 {color: #006600; font-weight: bold;} .asp .sy1 {color: #000000; font-weight: bold;} .asp .st0 {color: #cc0000;} .asp .nu0 {color: #800000;} .asp .me1 {color: #9900cc;} .asp .ln-xtra, .asp li.ln-xtra, .asp div.ln-xtra {color:black;background:#FFFF88;} .asp span.xtra { display:block; } .python .de1, .python .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000; margin: 0 0 0 -7px; position: relative; background: #ffffff;} .python { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .python .imp {font-weight: bold; color: red;} .python li, .python .li1 {background: #fff;list-style:none;margin:0;} .python .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .python .kw1 {color: #ff7700;font-weight:bold;} .python .kw2 {color: #008000;} .python .kw3 {color: #dc143c;} .python .kw4 {color: #0000cd;} .python .co1 {color: #808080; font-style: italic;} .python .coMULTI {color: #808080; font-style: italic;} .python .es0 {color: #000099; font-weight: bold;} .python .br0 {color: black;} .python .sy0 {color: #66cc66;} .python .st0 {color: #483d8b;} .python .nu0 {color: #ff4500;} .python .me1 {color: black;} .python .ln-xtra, .python li.ln-xtra, .python div.ln-xtra {color:black;background:#FFFF88;} .python span.xtra { display:block; } .java .de1, .java .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000; margin: 0 0 0 -7px; position: relative; background: #ffffff;} .java { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .java .imp {font-weight: bold; color: red;} .java li, .java .li1 {background: #fff;list-style:none;margin:0;} .java .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .java .kw1 {color: #000000; font-weight: bold;} .java .kw2 {color: #000066; font-weight: bold;} .java .kw3 {color: #003399;} .java .kw4 {color: #000066; font-weight: bold;} .java .co1 {color: #666666; font-style: italic;} .java .co2 {color: #006699;} .java .co3 {color: #008000; font-style: italic; font-weight: bold;} .java .coMULTI {color: #666666; font-style: italic;} .java .es0 {color: #000099; font-weight: bold;} .java .br0 {color: #009900;} .java .sy0 {color: #339933;} .java .st0 {color: #0000ff;} .java .nu0 {color: #cc66cc;} .java .me1 {color: #006633;} .java .me2 {color: #006633;} .java .ln-xtra, .java li.ln-xtra, .java div.ln-xtra {color:black;background:#FFFF88;} .java span.xtra { display:block; } .c .de1, .c .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .c { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .c .imp {font-weight: bold; color: red;} .c li, .c .li1 {background: #fff;list-style:none;margin:0;} .c .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .c .kw1 {color: #b1b100;} .c .kw2 {color: #000000; font-weight: bold;} .c .kw3 {color: #000066;} .c .kw4 {color: #993333;} .c .co1 {color: #666666; font-style: italic;} .c .co2 {color: #339933;} .c .coMULTI {color: #808080; font-style: italic;} .c .es0 {color: #000099; font-weight: bold;} .c .es1 {color: #000099; font-weight: bold;} .c .es2 {color: #660099; font-weight: bold;} .c .es3 {color: #660099; font-weight: bold;} .c .es4 {color: #660099; font-weight: bold;} .c .es5 {color: #006699; font-weight: bold;} .c .br0 {color: #009900;} .c .sy0 {color: #339933;} .c .st0 {color: #ff0000;} .c .nu0 {color: #0000dd;} .c .nu6 {color: #208080;} .c .nu8 {color: #208080;} .c .nu12 {color: #208080;} .c .nu16 {color:#800080;} .c .nu17 {color:#800080;} .c .nu18 {color:#800080;} .c .nu19 {color:#800080;} .c .me1 {color: #202020;} .c .me2 {color: #202020;} .c .ln-xtra, .c li.ln-xtra, .c div.ln-xtra {color:black;background:#FFFF88;} .c span.xtra { display:block; } .cpp .de1, .cpp .de2 {margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000;margin: 0 0 0 -7px; position: relative; background: #ffffff;} .cpp { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .cpp .imp {font-weight: bold; color: red;} .cpp li, .cpp .li1 {margin:0; list-style:none;} .cpp .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .cpp .kw1 {color: #0000ff;} .cpp .kw2 {color: #0000ff;} .cpp .kw3 {color: #0000dd;} .cpp .kw4 {color: #0000ff;} .cpp .co1 {color: #666666;} .cpp .co2 {color: #339900;} .cpp .coMULTI {color: #ff0000; font-style: italic;} .cpp .es0 {color: #000099; font-weight: bold;} .cpp .es1 {color: #000099; font-weight: bold;} .cpp .es2 {color: #660099; font-weight: bold;} .cpp .es3 {color: #660099; font-weight: bold;} .cpp .es4 {color: #660099; font-weight: bold;} .cpp .es5 {color: #006699; font-weight: bold;} .cpp .br0 {color: #008000;} .cpp .sy0 {color: #008000;} .cpp .sy1 {color: #000080;} .cpp .sy2 {color: #000040;} .cpp .sy3 {color: #000040;} .cpp .sy4 {color: #008080;} .cpp .st0 {color: #FF0000;} .cpp .nu0 {color: #0000dd;} .cpp .nu6 {color: #208080;} .cpp .nu8 {color: #208080;} .cpp .nu12 {color: #208080;} .cpp .nu16 {color:#800080;} .cpp .nu17 {color:#800080;} .cpp .nu18 {color:#800080;} .cpp .nu19 {color:#800080;} .cpp .me1 {color: #007788;} .cpp .me2 {color: #007788;} .cpp .ln-xtra, .cpp li.ln-xtra, .cpp div.ln-xtra {color:black;background:#FFFF88;} .cpp span.xtra { display:block; } .xml .de1, .xml .de2 { margin:0; padding: 0 5px; background:none; vertical-align:top;color:#000; margin: 0 0 0 -7px; position: relative; background: #ffffff;} .xml { color:#ACACAC; padding:5px; background-color: #F9F9F9; border: 1px dashed #C1C1C1; } .xml ol, .xml ol li { list-style:none; } .xml .imp {font-weight: bold; color: red;} .xml li, .xml .li1 {background: #fff; margin:0;} .xml .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;} .xml .es0 {color: #000099; font-weight: bold;} .xml .br0 {color: #66cc66;} .xml .sy0 {color: #66cc66;} .xml .st0 {color: #ff0000;} .xml .sc-1 {color: #808080; font-style: italic;} .xml .sc0 {color: #00bbdd;} .xml .sc1 {color: #ddbb00;} .xml .sc2 {color: #339933;} .xml .sc3 {color: #009900;} .xml .re0 {color: #000066;} .xml .re1 {color: #000000; font-weight: bold;} .xml .re2 {color: #000000; font-weight: bold;} .xml .ln-xtra, .xml li.ln-xtra, .xml div.ln-xtra {color:black;background:#FFFF88;} .xml span.xtra { display:block; } #zoom_pics { background-color: #F5F5F5; border-bottom: 1px solid #CCCCCC; border-left: 1px solid #CCCCCC; border-right: 1px solid #CCCCCC; border-style: none solid solid; padding: 5px; text-align: justify; } #zoom_fpnews1 { background: none repeat scroll 0 0 #FFFFFF; border-color: #CCCCCC; border-style: solid solid none; border-width: 1px; margin-bottom: 0; margin-top: 0; padding: 5px 5px 0; } </style> <div class="wrapper"> <main class="content"> <div class="breadth2 clearfix"> <div class="index-block block-blue"><h1>Server-Side Request Forgery [CWE-918]</h1></div> <div class="index-block block-white vulnerability-glossary"> <p class="news-preview">Server-Side Request Forgery or SSRF describes a case where the attacker can leverage the ability of a web application to perform unauthorized requests to internal or external systems.</p> <p><img src="/images/vulnerability/previews/server-side-request-forgery-ssrf-cwe-918.jpg" alt="Server-Side Request Forgery [CWE-918]" title="Server-Side Request Forgery [CWE-918]"/></p> <p><b>Created:</b> November 12, 2018 <br/><b>Latest Update:</b> December 28, 2020 <br/></p> <h3>Table of Content</h3> <ol> <li><a href="#description">Description</a></li> <li><a href="#impact">Potential impact</a></li> <li><a href="#software">Affected software</a></li> <li><a href="#exploitationexamples">Exploitation Examples</a></li> <li><a href="#severity">Severity and CVSS Scoring</a></li> <li><a href="#mitigations">Mitigations</a></li> <li><a href="#references">References</a></li> </ol> <p class="article-bookmark" style="margin-top: 26px;"> Want to have an in-depth understanding of all modern aspects of Server-Side Request Forgery [CWE-918]? Read carefully this article and <a href="#" onclick="return add_favorite(this);"><u>bookmark</u> </a> it to get back later, we regularly update this page. </p> <h3 id="description">1. Description</h3> <p> Server-side request forgery or SSRF leverages the ability of a web application to perform unauthorized requests to internal or external systems. If the web application contains functionality that sends requests to other servers and the attacker can interfere with it, it is possible to turn your web server into a proxy. Depending on the configuration of the web server, an attacker can reach systems that are otherwise behind a firewall, or access private resources on the localhost itself.</p> <h3 id="impact">2. Potential impact</h3> <p> The severity can vary from low to critical, depending on what the affected functionality can reach, either internally or externally. </p> <p><strong>Internal Service Interaction:</strong></p> <p> This is due to the vulnerable web application being used to interact with certain internal services, which in certain cases do not require authentication. Such examples are MongoDB and Redis. The impact can vary from minor information disclosure to database access, and even to remote code execution.</p> <p><strong>Information Disclosure:</strong></p> <p> Information disclosure via a port scan of internal hosts and enumeration of returned service banners is a common example. In some cases verbose error message will be returned to indicate the status of the port, in other cases a time-based approach must be used.</p> <p> If the web application is being hosted via a hosting provider, it is possible to disclose its instance metadata, such as public SSH keys, credentials, and private IP address blocks. </p> <p><strong>Local File Disclosure:</strong></p> <p> The vulnerability can also be used in some cases to read contents of local files on the web server. This is achieved by using an alternate handler: 'file://'. This can also lead to web application source code, configuration files, and various other sensitive files being read by an attacker. </p> <p><strong>Phishing:</strong></p> <p> SSRF can be used in conjunction with HTTP redirects to redirect a victim to a malicious web page. This can be used to serve malware, to harvesting credentials.</p> <div class="cwe-banner"> <div class="cwe-banner-blocks"> <div class="cwe-banner-block cwe-banner-block1"> <div class="cwe-banner-block-header">How to Detect Server-Side Request Forgery (SSRF) Vulnerabilities</div> </div> <div class="cwe-banner-block cwe-banner-block2"> <div class="cwe-banner-block-header">Website Security Test</div> <ul> <li>GDPR &amp; PCI DSS Test</li> <li>Website CMS Security Test</li> <li>CSP &amp; HTTP Headers Check</li> <li>WordPress &amp; Drupal Scanning</li> </ul> <a target="_blank" href="/websec/">Try For Free</a> </div> </div> </div> <h3 id="software">3. Affected software</h3> <p> Any code residing on the web server that an attacker can manipulate to insert arbitrary locations. This includes base web application functionality or third-party components. </p> <h3 id="exploitationexamples">4. Exploitation Examples</h3> <p> <strong>Case 1:</strong></p> <p> A typical exploitation scenario for web applications hosted on hosting provider platforms such as Amazon EC2 and Digital Ocean is to request the instance metadata service of each provider, which returns information about the hosted instance, such as the private IP subnet, OpenSSH public keys, and account details. </p> <p> An example request is as follows, the 'url' HTTP GET parameter is part of a vulnerable script that queries a remote URL and returns its contents to the page, in this case it will return the Amazon EC2 instance's public OpenSSH key:</p> <code class="code-block"> GET /search.php/?url=http://[host]/latest/meta-data/public-keys/0/openssh-key HTTP/1.1<br/> Host: companyx.com<br/> Content-Type: text/html<br/> </code> <p><strong>Case 2:</strong></p> <p> Another common example is for the vulnerable application to be used to read local files that the web server has the relevant access rights to. Examples could be database credentials, web application source code, SSH keys, or configuration files.</p> <p> The format of the following example request is the same as above. In this case it will return the '/etc/passwd' UNIX file, revealing the users of the underlying system. Note that the 'file://' handler is used instead of 'https://', this references local files:</p> <code class="code-block"> GET /search.php/?url=file:///etc/passwd HTTP/1.1<br/> Host: companyx.com<br/> Content-Type: text/html<br/> </code> <p>An example of vulnerable PHP code is shown below:</p> <p><b>cURL:</b></p> <code class="code-block"> &lt;?php<br/> $req = curl_init();<br/> curl_setopt($req, CURLOPT_URL, $_POST["handler"]); <br/> curl_setopt($req, CURLOPT_RETURNTRANSFER, 1);<br/> $output = curl_exec($req); <br/> curl_close($req);<br/> echo $output;<br/> ?&gt;<br/> </code> <p><b>fopen():</b></p> <code class="code-block"> &lt;?php<br/> if(isset($_GET['url']))<br/> {<br/> $url = $_GET['url'];<br/> $grab = fopen($url, 'rb');<br/> fpassthru($grab);<br/> header('Content-Type: text/html');<br/> echo $grab;<br/> }<br/> ?&gt;<br/> </code> <p><strong>An example of vulnerable Ruby code is shown below:</strong></p> <p><b>'open-uri' wrapper:</b></p> <code class="code-block"> open(URI(params[:url])).read </code> <p>An example of vulnerable Java code is shown below:</p> <code class="code-block"> InetAddress inetAddress = InetAddress.getByName(url.getHost());<br/> HttpURLConnection req = (HttpURLConnection)(url.openConnection());<br/> req.setInstanceFollowRedirects(true);<br/> req.connect();<br/> IOUtils.copy(req.getInputStream(), out);<br/> </code> <h3 id="severity">5. Severity and CVSS Scoring</h3> <p> The nature of what can be determined and accessed via the SSRF vulnerability will dictate the overall CVSS score. A few examples are shown below:</p> <p> If a level of privilege is required to exploit the vulnerability, and the SSRF vulnerability can be used to access the cloud host instance metadata and return credentials which can be used to access the instance, it should be scored as follows:</p> <p> 8.8 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H] – High severity.</p> <p>If no privilege is required, and the SSRF vulnerability can be used to determine open ports on the web server hosting the web application and other internal subnets, it should be scored as follows: 5.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N] – Medium severity.</p> <p>If no privilege is required, and the SSRF vulnerability can be used to read local files from the web server (in this example, files that reveal sensitive information), it should be scored as follows:</p> <p> 7.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N] – High Severity</p> <h3 id="mitigations">6. Mitigations</h3> <p> Maintain a whitelist of allowed DNS or IP addresses that the web application can access. If a blacklist is necessary, ensure that thorough validation is performed on user input, and that private IP addresses are not permitted. Ensure that only the HTTP(S) protocols can be used, and as before if it necessary to use alternate handlers, make sure robust whitelist is used. It is also necessary to prevent HTTP redirects.</p> <p>Common Fix Errors and Bypasses:</p> <p> It is dangerous to rely on a blacklist to filter user input, there are numerous techniques an attacker can use for various exploitation cases. A few basic examples are listed below:</p> <p><b>IP Address Encoding:</b></p> <p>Alternate IP addresses encodings can fool weak blacklists:</p> <table border="0" width="50%"> <tr><td>http://127.0.0.1:80/</td> <td>http://0.0.0.0:80/<br/> https://127.0.0.1:80/<br/> http://[::]:80/<br/> http://0000::1:80/<br/> http://1077.0.0.1/<br/> http://3232235521/<br/> </td></tr> </table> <p>If certain domain names are blacklisted, HTTP redirects can be used to bypass this restriction:</p> <p>http://companyx.app.localhost.127.0.0.1.nip.io - will use the ‘nip.io’ DNS service and resolve to localhost.</p> <p><b>URL Scheme Manipulation:</b></p> <code class="code-block"> file://\/\/etc/passwd </code> <h3 id="description">7. References</h3> <ul> <li><a href="https://cwe.mitre.org/data/definitions/918.html" rel="nofollow">CWE-918: Server-Side Request Forgery (SSRF) [MITRE]</a></li> <li><a href="https://www.owasp.org/index.php/Server_Side_Request_Forgery" rel="nofollow">Server Side Request Forgery [OWASP]</a></li> </ul> <br/> <p><b>Copyright Disclaimer:</b> <span style="text-decoration:underline;">Any above-mentioned content can be copied and used for <b>non-commercial</b> purposes only if proper credit to ImmuniWeb is given.</span></p> <a class="back2top" href="#toph1" rel="nofollow">↑ Back to Top</a><br/> <div class="socnetbtns"> <ul class="socnetbtnslist"> <li class="share-views"> 31.7k </li> <li class="share-linkedin"> <a rel="nofollow" target="_blank" href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html&amp;title=Server-Side Request Forgery CWE-918 Weakness Exploitation and Remediation" class="share-stat" share-type="linkedin"><span>180</span></a> </li> <li class="share-twitter"> <a rel="nofollow" target="_blank" href="https://twitter.com/intent/tweet?text=Server-Side+Request+Forgery+++CWE-918+Weakness+++Exploitation+and+Remediation%20https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html" class="share-stat" share-type="twitter"><span>178</span></a> </li> <li class="share-facebook"> <a rel="nofollow" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html" class="share-stat" share-type="facebook"><span>199</span></a> </li> <li class="share-email"> <a rel="nofollow" target="_blank" href="mailto:?subject=Server-Side Request Forgery CWE-918 Weakness Exploitation and Remediation&amp;body=https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html" class="share-stat" share-type="email"><span>104</span></a> </li> <li class="share-more onlymobile"> <a rel="nofollow" href="#" class="share-more-link">More</a> </li> <li class="share-whatsapp"> <a rel="nofollow" target="_blank" href="https://web.whatsapp.com/send?text=Server-Side Request Forgery CWE-918 Weakness Exploitation and Remediation: https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html" class="share-stat" share-type="whatsapp"><span>175</span></a> </li> <li class="share-pinterest"> <a rel="nofollow" target="_blank" href="https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html&amp;description=Server-Side+Request+Forgery+++CWE-918+Weakness+++Exploitation+and+Remediation" class="share-stat" share-type="pinterest"><span>178</span></a> </li> <li class="share-reddit"> <a rel="nofollow" target="_blank" href="https://www.reddit.com/submit?url=https%3A%2F%2Fwww.immuniweb.com%2Fvulnerability%2Fssrf.html&amp;title=Server-Side Request Forgery CWE-918 Weakness Exploitation and Remediation" class="share-stat" share-type="reddit"><span>177</span></a> </li> </ul> </div> </div> </div> </main> </div> <div class="index-block background-color" style="padding-bottom: 56px;" id="products"> <div class="title animation-slideup"> <h2>ImmuniWeb® AI Platform<br/> Use Cases</h2> </div> <div class="index-block__subtitle animation-slideup" style="margin-bottom: 0"> Instant Start. Rapid Delivery. </div> <div class="use-cases-block use-cases-block-main animation-slideup"> <div id="use_cases_menu" class="use-cases-menu use-cases-menu-col4"> <div> <a href="/use-cases/api-penetration-testing/" data-id="api-penetration-testing"><img width="22" height="22" src="/images/use-cases/api-penetration-testing.svg"/>API Penetration Testing</a> <a href="/use-cases/api-security-scanning/" data-id="api-security-scanning"><img src="/images/use-cases/api-security-scanning.svg" width="22" height="22"/>API Security Scanning</a> <a href="/use-cases/attack-surface-management/" data-id="attack-surface-management"><img width="22" height="22" src="/images/use-cases/attack-surface-management.svg"/>Attack Surface Management</a> <a href="/use-cases/cloud-penetration-testing/" data-id="cloud-penetration-testing"><img width="22" height="22" src="/images/use-cases/cloud-penetration-testing.svg"/>Cloud Penetration Testing</a> <a href="/use-cases/cloud-security-posture-management/" data-id="cloud-security-posture-management"><img width="22" height="22" src="/images/use-cases/cloud-security-posture-management.svg"/>Cloud Security Posture Management</a> </div> <div> <a href="/use-cases/continuous-penetration-testing/" data-id="continuous-penetration-testing"><img width="22" height="22" src="/images/use-cases/continuous-penetration-testing.svg"/>Continuous Penetration Testing</a> <a href="/use-cases/cyber-threat-intelligence/" data-id="cyber-threat-intelligence"><img width="22" height="22" src="/images/use-cases/cyber-threat-intelligence.svg"/>Cyber Threat Intelligence</a> <a href="/use-cases/dark-web-monitoring/" data-id="dark-web-monitoring"><img width="22" height="22" src="/images/use-cases/dark-web-monitoring.svg"/>Dark Web Monitoring</a> <a href="/use-cases/digital-brand-protection/" data-id="digital-brand-protection"><img width="22" height="22" src="/images/use-cases/digital-brand-protection.svg"/>Digital Brand Protection</a> <a href="/use-cases/gdpr-penetration-testing/" data-id="gdpr-penetration-testing"><img width="22" height="22" src="/images/use-cases/gdpr-penetration-testing.svg"/>GDPR Penetration Testing</a> </div> <div> <a href="/use-cases/mobile-penetration-testing/" data-id="mobile-application-penetration-testing"><img width="22" height="22" src="/images/use-cases/mobile-penetration-testing.svg"/>Mobile Penetration Testing</a> <a href="/use-cases/mobile-security-scanning/" data-id="mobile-security-scanning"><img width="22" height="22" src="/images/use-cases/mobile-security-scanning.svg"/>Mobile Security Scanning</a> <a href="/use-cases/network-security-assessment/" data-id="network-security-assessment"><img width="22" height="22" src="/images/use-cases/network-security-assessment.svg"/>Network Security Assessment</a> <a href="/use-cases/pcidss-penetration-testing/" data-id="pcidss-penetration-testing"><img width="22" height="22" src="/images/use-cases/pcidss-penetration-testing.svg"/>PCI DSS Penetration Testing</a> <a href="/use-cases/phishing-websites-takedown/" data-id="pcidss-penetraion-testing"><img src="/images/use-cases/phishing-websites-takedown.svg" width="22" height="22"/>Phishing Websites Takedown</a> </div> <div> <a href="/use-cases/red-teaming-exercise/" data-id="red-teaming-exercise"><img width="22" height="22" src="/images/use-cases/red-teaming-exercise.svg"/>Red Teaming Exercise</a> <a href="/use-cases/software-composition-analysis/" data-id="software-composition-analysis"><img width="22" height="22" src="/images/use-cases/web-application-scanning.svg"/>Software Composition Analysis</a> <a href="/use-cases/third-party-risk-management/" data-id="third-party-risk-management"><img width="22" height="22" src="/images/use-cases/third-party-risk-management.svg"/>Third-Party Risk Management</a> <a href="/use-cases/web-penetration-testing/" data-id="web-application-penetration-testing"><img width="22" height="22" src="/images/use-cases/web-application-penetration-testing.svg"/>Web Penetration Testing</a> <a href="/use-cases/web-security-scanning/" data-id="web-security-scanning"><img width="22" height="22" src="/images/use-cases/web-security-scanning.svg"/>Web Security Scanning</a> </div> </div> <div class="top-banner-ratio top-banner-ratio__btn"> <a href="/use-cases/">One Platform. All Needs.</a> </div> </div> </div> <div class="mobile-footer-wrapper"> <div class="mobile-footer-logo"> <a href="https://www.immuniweb.com/"><img class="b-lazy" data-src="/images/logo-immuniweb.svg" alt="ImmuniWeb - Web and Mobile Application Security" width="254" height="65" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <p>The award-winning ImmuniWeb® AI Platform helps over 1,000 customers from over 50 countries to test, secure and protect their web and mobile applications, cloud and network infrastructure, to prevent supply chain attacks and data breaches, and to comply with regulatory requirements.</p> </div> <div class="mobile-bottom"> <div class="reliable"> <a target="_blank" href="https://www.immuniweb.com/company/CREST-Penetration-Testing.pdf"> <img title="ImmuniWeb SA is a CREST accredited company" class="b-lazy" alt="ImmuniWeb SA is a CREST accredited company" data-src="/images/logo-crest.svg" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/> </a> <a target="_blank" href="https://www.immuniweb.com/company/ISO_9001_2023-2026.pdf"> <img title="ImmuniWeb SA is an ISO 9001:2015 certified company" class="b-lazy" alt="ImmuniWeb SA is an ISO 9001:2015 certified company" data-src="/images/logo-iso9001.svg" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/> </a> <a target="_blank" href="https://www.immuniweb.com/company/ISO_27001_2023-2026.pdf"> <img title="ImmuniWeb SA is an ISO 27001:2022 certified company" class="b-lazy" alt="ImmuniWeb SA is an ISO 27001:2022 certified company" data-src="/images/logo-iso27001.svg" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/> </a> <a target="_blank" href="https://www.immuniweb.com/company/ISO_27001_2020-2023.pdf"> <img title="ImmuniWeb SA is an ISO 27001:2022 certified company" class="b-lazy" alt="ImmuniWeb SA is an ISO 27001:2022 certified company" data-src="/i2/mobile-images/logo-ukas.svg" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==" style="height: 90px;"/> </a> </div> <div class="mobile-email"><noscript><img class="b-lazy" data-src="https://www.immuniweb.com/images/sales_at_immuniweb.com.png" alt="sales at immuniweb.com" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></noscript><a id="sales_email" href="#"/></div> <div class="mobile-address"> Quai de l’Ile 13<br/> CH-1204 Geneva<br/> Switzerland </div> <div class="mobile-bottom-socials"> <a target="_blank" href="https://www.linkedin.com/company/immuniweb" rel="nofollow"><img class="b-lazy" data-src="/i2/mobile-images/linkedin.svg" alt="ImmuniWeb on LinkedIn" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <a target="_blank" href="https://twitter.com/immuniweb"><img class="b-lazy" data-src="/i2/mobile-images/twitter.svg" alt="ImmuniWeb on Twitter" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <a target="_blank" href="https://chat.whatsapp.com/BtUTr8htygk3LJph2dFiQ2"><img class="b-lazy" data-src="/images/social/bottom/whatsapp.svg" alt="ImmuniWeb on WhatsApp" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <a target="_blank" href="https://t.me/immuniweb_ai"><img class="b-lazy" data-src="/images/social/bottom/telegram.svg" alt="ImmuniWeb on Telegram" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <a target="_blank" href="https://www.facebook.com/immuniweb"><img class="b-lazy" data-src="/i2/mobile-images/facebook.svg" alt="ImmuniWeb on Facebook" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> <a target="_blank" href="https://www.youtube.com/ImmuniWeb"><img class="b-lazy" data-src="/i2/mobile-images/youtube.svg" alt="ImmuniWeb on YouTube" src="data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=="/></a> </div> <div class="mobile-disclaimer"><a href="/pages/legal.html">Terms of Use</a> <a href="/pages/privacy.html">Privacy Policy</a></div> <div class="mobile-copyright">© Copyright 2024 ImmuniWeb SA</div> </div> </div> <div/> <div class="footer-static-buttons"> <div class="footer-static-buttons-btn footer-static-buttons-btn--demo"> <a href="/technology/demo/">Demo</a> </div> <div class="footer-static-buttons-btn footer-static-buttons-btn--pricing"> <a href="/technology/demo/">Pricing</a> </div> <div class="footer-static-buttons-btn footer-static-buttons-btn--subscribe"> <a href="/subscriptions/">Stay in Touch</a> </div> </div> <div class="cookie-privacy"> <p>This website uses cookies to provide you with a better surfing experience. To learn more, please visit our <a href="https://www.immuniweb.com/pages/privacy.html">Privacy Policy</a>. By continuing to use this website you consent to our use of cookies.</p> <button tabindex="0" class="cookie-privacy-btn">Accept</button> </div> </body>