External Service Interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server etc. The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. Type of External Service Interaction External Service Interaction (HTTP/HTTPS) External Servicie Interaction (DNS) Out-of-band Resource Load (HTTP) Note: Interactions are not limited to HTTP/HTTPS or DNS. It could lead to affect other network protocols such as FTP or SMTP etc.

1. External Service
Interaction

2. Hello! A bit about :)
I am a Lead Security consultant at Intel security.
LinkedIn: @iampawanphogat
2

3. External Service Interaction
Just another SSRF, sweet blind 
3
1

4. Overview
External Service Interaction arises when it is possible to induce an
application to interact with an arbitrary external service, such as a
web or mail server etc.
The ability to send requests to other systems can allow the
vulnerable server to be used as an attack proxy.
Target Scope: External third-party systems, Internal systems or local
loopback adapter of the application server itself
4

5. Continue..
Type of External Service Interaction
• External Service Interaction (HTTP/HTTPS)
• External Servicie Interaction (DNS)
• Out-of-band Resource Load (HTTP)
Note: Interactions are not limited to HTTP/HTTPS or DNS. It could lead to
affect other network protocols such as FTP or SMTP etc.
5

6. Continue..
Area of talk, External Service Interaction (DNS)
Why: Blind Amplified DNS based DDOS 
How: If a payload starting "http://..." causes a DNS-only interaction,
then this strongly indicates that outbound HTTP from the server is
being blocked. In this situation, a follow-up attack could target
public DNS servers.
Such weakness in application could be much severe with HPP
where payload pushed contains multiple “https://...” values.
Threat Agents: HTTP: GET & POST, REST endpoints etc.
6

7. Continue..
Area of talk, External Service Interaction (DNS)
7

8. Continue..
Area of talk, External Service Interaction (DNS)
8

9. Continue..
Area of talk, External Service Interaction (DNS)
9

10. Continue..
Area of talk, External Service Interaction (DNS)
Impact:
We can use the weakness as a attack proxy to DDOS all
Internal/external web conatiners, also could be amplified too 
Scope:
Internal, External or Internet
10

11. Continue..
Area of talk, External Service Interaction (DNS)
POC : Proof of Concept
11
Machines Info:
X.X.X.31 : Attacker/User
X.X.X.5 : Backend App/Web Server
X.X.X.2 : Backend DNS Server
External resource:

12. Mitigate Threat
▰ Review source code for
functions such as dns.resolve(),
dns.query() etc.
▰ Use whitelist check, boundary
based validation and
sanitization
▰ Maintain whitelist at network
and web front
YOU CAN ALSO SPLIT YOUR CONTENT
12

13. “
Automation is new voldemort.
1313

14. 14
THANKS!
Any questions?