0

A cool pivot to escalate the SSRF to a Remote Code Execution (RCE) is by pushing asynchronous jobs on a Redis queue that then get executed by an application using the gopher:// protocol. It’s really convenient that a lot of Redis instances don’t use any form of authentication. Exploiting this, however, warrants its own blog post given the debugging you have to do. Something for another blogpost!

Source

In the first sentence, 'A cool pivot to escalate ... (RCE)' is the subject follows by the predicate 'is'. What's the rest of the sentence. 'Pushing asynchronous jobs on a Redis queue that then get executed by an application using the gopher:// protocol is the pivot to escalate the SSRF to a Remote Code Execution', is this synonym for the origin? And I don't know what 'that then get executed' is used to describe(the Remote code or Redis queue), I guess that is Remote code. I would appreciate it if anything help.

Improve this question
6
  • 1
    What do you mean, "should I translate"?
    – Andrew Leach ♦
    Commented Jun 20, 2017 at 13:24
  • The second sentence is pointing to the lack of security in many 'Redis' instances.
    – Lawrence
    Commented Jun 20, 2017 at 15:34
  • 2
    The text under discussion is technical in nature. If you don't know the technical meaning of the words, "Remote Code Execution", "asynchronous", "queue", "protocol", or "authentication" then ELU is the wrong forum for your question. Try to research the terms by searching SO.
    – MikeJRamsey56
    Commented Jun 20, 2017 at 17:57
  • @AndrewLeach Because I like this article so much then prepare to translate it into Chinese。
    – Ꭰ_Ꭰ
    Commented Jun 21, 2017 at 2:36
  • @MikeJRamsey56 Thank u. I'm having problem in the sentence structure and syntax instead of the term。
    – Ꭰ_Ꭰ
    Commented Jun 21, 2017 at 2:40

1 Answer 1

Reset to default
3

The clauses are:

A cool pivot
  to escalate the SSRF
    to a Remote Code Execution (RCE) 
is 
  by pushing asynchronous jobs
    on(to) a Redis queue
      that then get executed
        by an application 
          using the gopher:// protocol.

It is the jobs that are executed. The jobs are executed in the sequence in which they were placed in the queue. First in, first out. You have to define an application that gets triggered when a job appears on the queue. That application uses the "gopher://" protocol to execute the job.

Further details are technical and are more appropriately discussed on Stackoverflow.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .