├── Dockerfile ├── Host_header ├── README.md ├── default └── images │ ├── Nginx_config.png │ ├── SSRF.png │ ├── actual_request.png │ └── readme.md ├── LICENSE.md ├── README.md └── www ├── DNS Rebinding based Bypass ├── README.md └── images │ ├── DNS_Rebinding_Attack_1.png │ ├── DNS_Rebinding_Attack_10.png │ ├── DNS_Rebinding_Attack_11.png │ ├── DNS_Rebinding_Attack_12.png │ ├── DNS_Rebinding_Attack_13.png │ ├── DNS_Rebinding_Attack_2.png │ ├── DNS_Rebinding_Attack_3.png │ ├── DNS_Rebinding_Attack_4.png │ ├── DNS_Rebinding_Attack_5.png │ ├── DNS_Rebinding_Attack_6.png │ ├── DNS_Rebinding_Attack_7.png │ ├── DNS_Rebinding_Attack_8.png │ ├── DNS_Rebinding_Attack_9.png │ └── README.md ├── DNS-Spoofing-based-Bypass ├── README.md └── images │ ├── README.md │ ├── dns spoofing 1.png │ ├── dns spoofing 2.png │ ├── dns spoofing 3.png │ ├── dns spoofing 4.png │ ├── dns spoofing 5.png │ ├── dns spoofing 6.png │ └── dns spoofing 7.png ├── File_Download ├── README.md └── images │ ├── README.md │ ├── file_download_1.png │ ├── file_download_10.png │ ├── file_download_11.png │ ├── file_download_2.png │ ├── file_download_3.png │ ├── file_download_4.png │ ├── file_download_6.png │ ├── file_download_7.png │ ├── file_download_8.png │ └── file_download_9.png ├── Remote_host_connect_interface ├── README.md └── images │ ├── MySQL_Connect_1.png │ ├── MySQL_Connect_2.png │ ├── MySQL_Connect_3.png │ ├── MySQL_Connect_4.png │ ├── MySQL_Connect_5.png │ ├── MySQL_Connect_6.png │ ├── MySQL_Connect_7.png │ └── README.md ├── XML ├── images │ └── README.md ├── sample_upload.xml └── ssrf_using_xxe.xml ├── all.css ├── dns-spoofing.php ├── dns_rebinding.php ├── download.php ├── file_content_fetch ├── README.md └── images │ ├── README.md │ ├── file1.png │ ├── file2.png │ ├── file3.png │ ├── file4.png │ ├── file5.png │ └── file6.png ├── file_get_content.php ├── head.php ├── images ├── README.md ├── SSRF_Vulnerable_Lab.png ├── head.jpg ├── indishell.jpg ├── matrix2.gif ├── ssrf_lab.gif └── who.jpg ├── index.php ├── local.txt ├── pdf_generator ├── images │ ├── README.md │ ├── w1.png │ ├── w2.png │ ├── w3.png │ ├── w4.png │ ├── w5.png │ ├── wk1.png │ ├── wk2.png │ ├── wk3.png │ └── wk4.png ├── readme.md └── weasy.py ├── pdf_ssrf_weasyprint.php ├── pdf_ssrf_wkhtmltopdf.php ├── sql_connect.php └── xml_ssrf.php /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM php:7.2-apache 2 | 3 | RUN apt update && apt install -y xvfb libfontconfig wkhtmltopdf build-essential python-dev python-pip python-cffi libcairo2 libpango1.0-0 libpangocairo-1.0.0 libgdk-pixbuf2.0-0 libffi-dev shared-mime-info && python2 -m pip install "weasyprint<43" 4 | 5 | 6 | RUN docker-php-ext-install mysqli pdo pdo_mysql && docker-php-ext-enable mysqli 7 | RUN chown www-data:www-data /var/www/html/ 8 | 9 | ADD www /var/www/html/ 10 | 11 | 12 | EXPOSE 80 13 | CMD ["apache2ctl", "-D", "FOREGROUND"] 14 | -------------------------------------------------------------------------------- /Host_header/README.md: -------------------------------------------------------------------------------- 1 | ### Description: 2 | 3 | This is a Host-header based SSRF example. In this type of SSRF, any IP/Hostname entered in the host header is parsed by the vulnerable server. 4 | The vunerable server ends up routing the request to the specified domain/IP and retrieves the contents, returning them in the HTTP response. This type of misconfiguration can easily be exploited to exfiltrate data from sensitive locations (e.g. Internal locations, AWS metadata, local files, etc.) 5 | 6 | This misconfiguration is usually seen in web servers that act like a proxy, such as Squid proxy, Nginx and Apache. 7 | 8 | 9 |

1. Install NGINX web server in Ubuntu machine:

10 | 11 | apt-get install nginx 12 | 13 |

2. Replace the content of below mentioned file with this NGINX web server Default file:

14 | 15 | 16 | /etc/nginx/site-available/default 17 | 18 | 19 | 20 |

3. Reload NGINX web server using below mentioned command:

21 | 22 | service nginx reload 23 | 24 |

4. Server-side request forgery exploitation:

25 | 26 | In Burp suite, send request to repeater tab and click `Send` button: 27 | 28 | 29 | 30 | Now, when we change the value of `Host` header with some other hostname/IP (192.168.56.104 in this case), web proxy server makes HTTP request to that host and returns HTTP response from that host: 31 | 32 | 33 | 34 | ./init 0 35 | -------------------------------------------------------------------------------- /Host_header/default: -------------------------------------------------------------------------------- 1 | 2 | 3 | server { 4 | listen 80 default_server; 5 | listen [::]:80 default_server; 6 | 7 | 8 | root /usr/share/nginx/html; 9 | 10 | # Add index.php to the list if you are using PHP 11 | index index.html index.htm index.nginx-debian.html; 12 | 13 | server_name _; 14 | 15 | location / { 16 | 17 | 18 | resolver 8.8.8.8; 19 | default_type ""; 20 | if ($http_host != $server_addr) 21 | { 22 | 23 | proxy_pass $scheme://$http_host$uri$is_args$args; 24 | } 25 | 26 | } 27 | 28 | 29 | } 30 | 31 | 32 | -------------------------------------------------------------------------------- /Host_header/images/Nginx_config.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/Host_header/images/Nginx_config.png -------------------------------------------------------------------------------- /Host_header/images/SSRF.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/Host_header/images/SSRF.png -------------------------------------------------------------------------------- /Host_header/images/actual_request.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/Host_header/images/actual_request.png -------------------------------------------------------------------------------- /Host_header/images/readme.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 incredibleindishell and contributors 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Server-Side Request Forgery (SSRF) vulnerable Lab 2 | This repository contain PHP codes which are vulnerable to Server-Side Request Forgery (SSRF) attack. 3 | 4 | I would like to say Thank You to @albinowax, AKReddy, Vivek Sir (For being great personalities who always supported me), Andrew Sir - @vanderaj (for his encouraging words) and those researchers who contirubuted in DNS rebinding attack based research 5 | 6 | ![](https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/master/www/images/SSRF_Vulnerable_Lab.png) 7 | 8 | Vulnerable codes are meant to demonstrate SSRF for below mentioned 5 scenarios: 9 | 10 | 1. Application code that fetches and display the content of the specified file 11 | 12 | In programming languages, there are functions which can fetch the contents of locally saved file. These functions may be capable of fetching the content from remote URLs as well local files (e.g file_get_contents in PHP). 13 | 14 | This functionality can be abused if application is not prepending any string to the user supplied data to fetch the content from a file i.e application is not prepeding and directory name or path to the user supplied data. 15 | 16 | In this case, these data fetching function can process the schemes like "http://" or "file://". When user specifies the remote URL in place of file name like "http://localhost", the data fetching function extract the data from the specified URL. 17 | 18 | In case if application is prepending any data string (for example any directory name) to user data, "http://" or "file://" scheme won't work and exploitation of SSRF vulnerability is not possible. 19 | 20 | Guide to Exploitation of Scenario 1 21 | 22 | 2. Application provides interface to connect to Remote Host 23 | 24 | Web application has interfaces that allow an user to specify the any IP with any port. Here the application has functionality which tries to connect to service like "MySQL", "LDAP" etc. 25 | 26 | Application expects user to specify the remote server hostname/IP, username and password in input fields. Application then tries to connect to the remote server over specified port. Here in this scenario, application tries to communicate to remote service listening on specific port. When vulnerable code has functionality to connect to server like MySQL and user specified the SMB port, vulnerable application will try to communicate to SMB servie using MySQL server service packets. Even though, the port is open, we are not able to communicate to the service due to difference in way of communication. 27 | 28 | This behaviour can be exploited to perform internal network scanning not just to enumerate IPs but Ports as well on those live IPs. 29 | 30 | Guide to Exploitation of Scenario 2 31 | 32 | 3. Application with File Download Functionality 33 | 34 | In this case, an attacker can exploit this functionality to perform IP scanning inside the network where application server is hosted. 35 | The function which performs the task of downloading file from server, can download file not just from local server but also from SMB path as well. This is something which can help an attacker to figure out the Windows based machines in the network. 36 | 37 | Web application hosted on Windows OS will process the SMB path as well if file download functionality is processing user input without prepending any data. 38 | 39 | Guide to Exploitation of Scenario 3 40 | 41 | 4. Bypassing IP blacklisting using DNS Based Spoofing 42 | 43 | The script has funcionality which allow user to fetch data from remote URL. User need to specify the remote URL with any IP or domain name. 44 | 45 | The script perform check if user has specified the input as "localhost", "Internal IPs" or "Reserved IPs". If domain/IP specified by user is blacklisted, script will not fetch the content and stop processing. 46 | 47 | Guide to Exploitation of Scenario 4 48 | 49 | 5. Bypassing IP blacklisting using DNS Rebinding Technique 50 | 51 | Application has implemented black listing of not just internal and private range IPs but also rsolve the user supplied domain to its IP and again perform check if resolved is black listed or not. 52 | 53 | In this case, DNS based spoofing trick will also not work to access the content hosted on internal/Reserved IP. Application code perform domain resolution to its IP and again perform black listed IP check for the resolved IP. 54 | 55 | Guide to Exploitation of Scenario 5 56 | 57 | 6. SSRF in HTML to PDF generator script 58 | 59 | This the scenrio of the web app which is using HTML to PDF generator script and passing untrusted user supplied data to HTML file which is processed by HTML to PDF generator. 60 | 61 | Guide to Exploitation of Scenario 6 62 | 63 | Ofcourse,
--==[[ With Love From IndiShell ]]==-- 64 | 65 | 66 | 67 | --==[[ Greetz To ]]==-- 68 | 69 | Guru ji zero, Code breaker ICA, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba, 70 | Silent poison India, Magnum sniper, ethicalnoob Indishell, Reborn India, L0rd Crus4d3r, cool toad, 71 | Hackuin, Alicks, mike waals, cyber gladiator, Cyber Ace, Golden boy INDIA, d3, rafay baloch, nag256 72 | Ketan Singh, AR AR, saad abbasi, Minhal Mehdi, Raj bhai ji, Hacking queen, lovetherisk, D2, Bikash Dash and rest of the Team INDISHELL 73 | 74 | --==[[Love to]]==-- 75 | 76 | My Father, my Ex Teacher, Lovey, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP 77 | Mohit, Ffe, Shardhanand, Budhaoo, Hacker fantastic, Jennifer Arcuri, Thecolonial, Anurag Bhai Ji and Don(Deepika kaushik) 78 | 79 | 80 | ## Docker 81 | There is a [Dockerfile](./Dockerfile) in this repo that will spin up a vulnerable [docker](https://docker.com) image. 82 | To build it, simply run `docker build -t .`. 83 | The Apache server is running on port 80 inside the container. 84 | Expose it with the `-p` flag. 85 | Running it with `docker run -p 9000:80 ` will bring up a container listening on [localhost:9000](http://localhost:9000). 86 | -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/README.md: -------------------------------------------------------------------------------- 1 | # DNS Rebinding based Bypass 2 | 3 | Exploitation Difficulty : Medium 4 | This is the advanced example of Server-Side Request Forgery (SSRF) attack exploitation. Application code has check for user input data and process if and only domain/IP is not black listed. 5 | Attacker need to bypass this protection via DNS rebinding Attack. 6 | 7 |

Issue observation and exploitation scenario

8 | When application has implemented black listing of not just internal and private range IPs but also rsolve the user supplied domain to its IP and again perform check if resolved is black listed or not. 9 | 10 | In this case, DNS based spoofing trick will also not work to access the content hosted on internal/Reserved IP. 11 | Application code perform domain resolution to its IP and again perform black listed IP check for the resolved IP. 12 | 13 | 14 |

Vulnerable Script exploitation

15 | In this example, application has functionality to fetch and display the content of the remotly hosted file. Application has file "box.txt" hosted on internal URL "http://127.0.0.1/box.txt". 16 | 17 |

Web application default functionality

18 | Application code allow a user to fetch the content of remotly hosted file from an IP or Domain. 19 | 20 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_1.png?raw=true) 21 | 22 | Application perform check if specified domain or IP is in blacklist or not. If Domain is not black listed, application fetch and serve the content of the remote URL. 23 | 24 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_2.png?raw=true) 25 | 26 | Application do not allow user to fetch the content from Internal/Reserved IP range. When user try to access the files hosted on internal IP, code perform check. 27 | 28 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_3.png?raw=true) 29 | 30 | Request will net get processed if user specified IP found in blacklist. 31 | 32 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_4.png?raw=true) 33 | 34 | Application do not relaying on IP based check. It also perform check to which IP user specified Domain name is pointing to. 35 | In this case, Domain name "b0x.mannulinux.org" is pointing to IP "127.0.0.1" 36 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_5.png?raw=true) 37 | 38 | User trying to access the content of the file hosted on URL "127.0.0.1/box.txt" by trying DNS based Spoofing trick and ask application to fetch the content from URL "b0x.mannulinux.org". As, "b0x.mannulinux.org" is pointing to "127.0.0.1", the URL "b0x.mannulinux.org/box.txt" pointing to "127.0.0.1/box.txt" 39 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_6.png?raw=true) 40 | 41 | Application code resolved the user specified Domain name to the IP and blacked the processing because resolved IP is in blacklist. 42 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_7.png?raw=true) 43 | 44 | 45 |

DNS Rebind Technique

46 | DNS Rebinding technique is the one in which Web Browser or Web Server is tricked to make request to the already resolved Domain and this time DNS return different IP then the one which was provided previously. 47 | In this attack technique, user bind a Sub-Domain to 2 different IPs or use malicious DNS server which is capable of changing the Domain IP address inbetween 2 different IPs. 48 | 49 | Time To Live (TTL) for a DNS entry 50 | 51 | When user specify the web application sub-domain entry, user can specify the "TTL" value atleast 1 minute. This attribute instruct web server or browser that the resolved IP for the Domain will be valid of this time period only and need to make another DNS request when domain need to be accessed. 52 | 53 | Here, attacker will configure the both the IPs of Sub-Domain/Domain with "TTL" 1 minute. Now, DNS will server different-2 IP when web server is going to make request after difference of 1 minute due to the "TTL" and 2 IPs binded to it. 54 | 55 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_13.png?raw=true) 56 | 57 | This behavior will help in bypassing the security check in the code. Application code has 2 different code sections: 58 | 1) Application first code section is meant for performing the check if IP/Domain is in blacklist or not. If IP or Domain IP resloved, is in blacklist, application will stop the further processing. 59 | 60 | 2) Second code section is the one which come in action once security check has been passed by IP/Domain. This code section perform the further functionality. In this script, code is fetching the content from the specified URL. 61 | 62 |

Attack Scenario outline

63 | 64 | -> Web application expect user to specify a Domain 65 | 66 | -> User specify the domain which has 2 IPs binded to it in DNS server. 67 | 68 | -> Application process the user request and resolve the domain to Blocked IP (127.0.0.1 in this case) and prompt with error message. 69 | 70 | -> User keep try to trigger same HTTP request again and again. When TTL expire for the Domain IP, Web server will resolve the IP again. 71 | 72 | -> Now, web server will request DNS server to resolve the IP of the domain and this time DNS return different IP which is not blacklisted (8.8.8.8). 73 | 74 | -> Security check will get pass and application will continue the process to fetch the content from the specified URL. 75 | 76 | -> Data fetching functiona will resolve the IP of the Domain and get the blacklisted IP (127.0.0.1). As now, security check has been passed, application wont stop processing and will fetch the content from the blacklisted IP. 77 | 78 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS%20Rebinding%20based%20Bypass/images/DNS_Rebinding_Attack_12.png?raw=true) 79 | 80 | ./thanks 81 | -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_1.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_10.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_11.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_12.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_12.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_13.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_13.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_2.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_3.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_4.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_5.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_6.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_7.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_8.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS Rebinding based Bypass/images/DNS_Rebinding_Attack_9.png -------------------------------------------------------------------------------- /www/DNS Rebinding based Bypass/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/README.md: -------------------------------------------------------------------------------- 1 | # DNS Based Spoofing (dns-spoofing.php) 2 | 3 | The script has funcionality which allow user to fetch data from remote URL. User need to specify the remote URL with any IP or domain name. 4 | 5 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%201.png?raw=true) 6 | 7 | This script perform check if user has specified the input as "localhost", "Internal IPs" or "Reserved IPs". If domain/IP spcified by user is blacklisted, script will not fetch the content and stop processing. 8 | 9 |

Fetching data from remote domain

10 | 11 | In below example, user spcified the remote application URL as "https://www.google.com" and script fetched the data from the URL. 12 | 13 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%202.png?raw=true) 14 | 15 |

Script behavior when user try to access blacklisted IP

16 | 17 | We have a file "box.txt" hosted on local server where script is hosted and URL is "http://127.0.0.1/box.txt" 18 | 19 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%203.png?raw=true) 20 | 21 | Now, when a user try to access the file "box.txt" by specifying the URL to local IP, script perform check and block it. 22 | 23 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%204.png?raw=true) 24 | 25 | Or when user try to access reserved IPs, script will block them too. 26 | 27 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%205.png?raw=true) 28 | 29 | In this case, malicious user can use "DNS Based spoofing" to bind internal IP with a domain name. In DNS server, malicious user need to point the domain name to the IP which is blacklisted. 30 | 31 | For example, in this case user is trying to access the internal IP "127.0.0.1" and reserved IP "169.254.169.254". I created 2 enteries for the these 2 IPs and pointed the domain name "b0x.mannulinux.org", "gcp.mannulinux.org" to "internal IP" and "reserved IP" respectively. 32 | 33 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%206.png?raw=true) 34 | 35 | In above example, nslookup command is showing that domain "box.mannulinux.org" is pointing to IP "127.0.0.1". 36 | 37 | Now, attacker can trick script to access locally hosted file "box.txt" by specifying the URL like "http://b0x.mannulinux.org/box.txt". 38 | When script will perform check, domain "box.mannulinux.org" is not part of blacklist and will proceed for fetching content of the file "box.txt" from from domain "b0x.mannulinux.org". 39 | 40 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/DNS-Spoofing-based-Bypass/images/dns%20spoofing%207.png?raw=true) 41 | 42 | This is how an attacker can bypass the weakly implemented Domain/IP blacklisting. 43 | 44 | ./Thanks 45 | -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 1.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 2.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 3.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 4.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 5.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 6.png -------------------------------------------------------------------------------- /www/DNS-Spoofing-based-Bypass/images/dns spoofing 7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/DNS-Spoofing-based-Bypass/images/dns spoofing 7.png -------------------------------------------------------------------------------- /www/File_Download/README.md: -------------------------------------------------------------------------------- 1 | # SSRF in File Download Functionality 2 | 3 | Diffeculty Level: Easy 4 | 5 | Web application has file download functionality which expect file name as user input. Application process the file name specified by the user and search it in the internal directory. Application fecth the content of the file and prompt user with file download message box. 6 | 7 |

Issue observation and exploitation scenario

8 | In this case, an attacker can exploit this functionality to perform IP scanning inside the network where application server is hosted. 9 | 10 | The function which performs the task of downloding file from server, can download file not just from local server but also from SMB path as well. This is something which can help an attacker to figureout the windows based machines in the network. 11 | 12 | Web application hosted on Windows OS will process the SMB path as well if file download functionality is processing user input without prepending any data. 13 | 14 | There will be three possible observations in this case: 15 | 16 | 1). Live IP with open SMB port 17 | 2). IP is live but port is closed 18 | 3). IP itself is not live 19 | 20 | Live IP with open SMB port In this case, web application will try to access the default admin share "IPC$" via SMB and remote server will ask for credentials. As application triggered request without credendials, remote IP will stop processing the file download request and web application will return HTTP response in some specific time period. Note the HTTP response time. 21 | 22 | IP is live but port is not closed In this case, web application will try to access the port of the IP. Here, IP is live but port is not open. Web application will try to establish connection to the closed port which result in rises of "Connection Refused" error message. For this situation, web application will return HTTP response in some specific time period. Note the HTTP response time. The response time period will be more than the time period from above case. 23 | 24 | IP itself is not live In this case, web application will try to establish communication to the IP which is not live. Here, IP itself is not live. Web application will try to establish communication to the IP which result in rises of "Host has failed to respond" error message. For this situation, web application will have take huge time to respond. This behavior will indicate that remote IP is not live 25 | 26 | How to figureout the time difference for different-2 test case 27 | 28 | To get the time difference for the case when IP is live with closed port, try with "Burp Collaborator" server. Collaborator server dont have SMB port open on it. But if application is hosted inside the network which is not allowing routing of SMB traffic outside the network, trick wont work. In this case, try to download "hosts" or "web.config" file from server and get internal IPs. 29 | 30 | To get the time difference for the case when IP itself is not live, specify an IP which is not live at all. Note the HTTP response time period and use the observed time value to figureout the dead IPs in your result while perfoming the testing. 31 | 32 |

Web application default functionality

33 | Web application has file download functionality which allow user to download file from server. If file is not present, application prompt with error message that "File not found". 34 | 35 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_1.png?raw=true) 36 | 37 | Web browser prompt user with file donwload message box 38 | 39 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_2.png?raw=true) 40 | 41 | Confirm whether application is prepending any data to user specified value or not because it is important to perform SSRF exploitation. If application is prepending any data to user input, application will not accept full path to the system internal file and user will not get any file download message box. 42 | 43 | To confirm if application is not prepending any data to user input, try to download system file which will be there in Windows machine for sure. One such file is "hosts" inside the diectory "c:/windows/system32/drivers/etc/". 44 | 45 | Specified the internal path to file "hosts" in inout field which is "c:/windows/system32/drivers/etc/hosts" and try to download. 46 | 47 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_3.png?raw=true) 48 | 49 | Application is processing user specified file path and not prepending any data to it. 50 | 51 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_4.png?raw=true) 52 | 53 | Now, we can go for the exploitation. An attacker can specify the SMB path to internal IP with "IPC$" admin share and random file name inside the share. 54 | 55 | The payload will be like this "\\\\Internal_IP\IPC$\box.txt". 56 | Specify the SMB path to an IP which has Windows OS runnning on it. In the environment, there was one Windows machine with SMB port open. 57 | 58 | Case 1: Live IP with Open SMB port 59 | 60 | IP of the machine which is hosted inside the network and has SMB port on it. 61 | 62 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_8.png?raw=true) 63 | 64 | Web application response time behavior for the case when IP is live and port 445 is open was osbeerved like this 65 | 66 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_9.png?raw=true) 67 | 68 | Case 2: IP is Live but port is closed 69 | 70 | In network, there may be IPs which are live but SMB port is not live. For those IPs, application response will be different as IP is live but SMB port is not open. Application keep trying to comunicate to the IP on port 445. Due to this process application HTTP response time will be different 71 | 72 | There was an IP which is Live and running Linux OS with SMB port closed. 73 | 74 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_10.png?raw=true) 75 | 76 | Web application response time behavior for the case when IP is live and port 445 is cloased was observed like this 77 | 78 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_11.png?raw=true) 79 | 80 | 81 | Case 3: IP itself is not live 82 | 83 | In network, there may be IPs which are not live. For those IPs, application response will be different as IP is not live and application keep trying to comunicate to the IP. In this case application HTTP response will have huge difference then the one in which IP was live. 84 | 85 | There was an IP which as not Live in the environment. 86 | 87 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_6.png?raw=true) 88 | 89 | Web application response time behavior for the case when IP is not live was observed like this 90 | 91 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/File_Download/images/file_download_7.png?raw=true) 92 | 93 | ./Thanks 94 | -------------------------------------------------------------------------------- /www/File_Download/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/File_Download/images/file_download_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_1.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_10.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_11.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_2.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_3.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_4.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_6.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_7.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_8.png -------------------------------------------------------------------------------- /www/File_Download/images/file_download_9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/File_Download/images/file_download_9.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/README.md: -------------------------------------------------------------------------------- 1 | # Application provide interface to connect to Remote Host 2 | 3 | Exploitation Difficulty : Easy
4 | This is the simple level Server-Side Request Forgery (SSRF) vulnerability scenario. In such type of case, application will have interface which allow user to specify the remote hostname/IP. 5 | 6 | 7 | Issue observation and exploitation scenario
8 | Web application has interface allow an user to specify the any IP with any port. Here application may have functionality like, it try to connect to service like "MySQL", "LDAP" etc. 9 | 10 | Application expect user to specify the remote server hostname/IP, username and password in input fields. Application try to connect to the remote server over specified port. 11 | Here, application try to communicate to remote service listening on specific port. 12 | When vulnerable code has functionality to connect to server like MySQL and user specified the SMB port, vulnerable application will try to communicate to SMB servie using MySQL server service packets. 13 | Now, port is open, but services are not able to communicate due to difference in way of communication. 14 | 15 | This behaviour can be exploited to perform internal network scanning not just to enumerate IPs but Ports as well on those live IPs. 16 | 17 | In this example, script try to connect to remote SQL server. 18 | 19 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_1.png?raw=true) 20 | 21 | Following 3 type of behavior will be obsered in this case whicn are following: 22 | 23 | 1) If remote IP is not having port open, script shows error message "No connection could be made because the target machine actively refused it". 24 | 2) If remote IP is having port open on it but SQL server is not listening on it, script shows error message "SQL server has gone away". 25 | 3) If remote IP does not exist, script throws error message "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond." 26 | 27 | Case 1: IP is live and Port is open 28 | 29 | In this case, remote IP is up and port is open. So when application try to communicate to the service on the remote IP port, application script feels that Port is open but service is not responding. Due to this observation, application script trigger message such as "Service has gone down". 30 | 31 | Specified the SMB port along local IP 32 | 33 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_2.png?raw=true) 34 | 35 | Application vulnerable code response will print message "Service Gone" which indicate "SMB" port was open on local machine. 36 | 37 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_3.png?raw=true) 38 | 39 | Case 2: IP is live and Port is Closed 40 | 41 | In this case, remote IP is up but port is closed. So when application try to communicate to the service on the remote IP port, application script keep trying to connect to the port, take much time and finally connection timeout happens. Due to this observation, application script print message like "Connection refused". 42 | 43 | Specified the random port which is not open along local IP 44 | 45 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_4.png?raw=true) 46 | 47 | Application vulnerable code response indicate that random port was not open on local machine. 48 | 49 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_5.png?raw=true) 50 | 51 | Case 3: IP is not live 52 | 53 | In this case, remote IP itself is not live. So when application try to communicate to the service on the remote IP port, application script keep trying to establish connection to remote IP, take more time than case 2 and finally connection timeout happens. Due to this observation, application script print message like "Third party not responding" which indicate that IP is not live. 54 | 55 | Specified the SMB port along remote IP which is not live on network 56 | 57 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_6.png?raw=true) 58 | 59 | Application vulnerable code response indicate that Remote IP is not live. 60 | 61 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/Remote_host_connect_interface/images/MySQL_Connect_7.png?raw=true) 62 | 63 | ./Thanks 64 | 65 | -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_1.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_2.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_3.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_4.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_5.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_6.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/MySQL_Connect_7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/Remote_host_connect_interface/images/MySQL_Connect_7.png -------------------------------------------------------------------------------- /www/Remote_host_connect_interface/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/XML/images/README.md: -------------------------------------------------------------------------------- 1 | POC images for the vunerability demo. 2 | -------------------------------------------------------------------------------- /www/XML/sample_upload.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Edward Newgate 5 | Captain 6 | Gura-Gura no-mi 7 | A "Quake Man". 8 | 9 | 10 | Marco - The Phoenix 11 | First Division Commander 12 | Mythical Zoan type 13 | Can transform into a phoenix. 14 | 15 | 16 | Fire fist - Ace 17 | Second Division Commander 18 | Mera Mera no Mi 19 | Can create, control, and transform into fire at will. 20 | 21 | 22 | -------------------------------------------------------------------------------- /www/XML/ssrf_using_xxe.xml: -------------------------------------------------------------------------------- 1 | 2 | 4 | ]> 5 | 6 | 7 | Edward Newgate 8 | Captain 9 | &xxe; 10 | A "Quake Man". 11 | 12 | 13 | Marco - The Phoenix 14 | First Division Commander 15 | Mythical Zoan type 16 | Can transform into a phoenix. 17 | 18 | 19 | Fire fist - Ace 20 | Second Division Commander 21 | Mera Mera no Mi 22 | Can create, control, and transform into fire at will. 23 | 24 | 25 | -------------------------------------------------------------------------------- /www/all.css: -------------------------------------------------------------------------------- 1 | body { 2 | background: url(images/head.jpg); 3 | background-size: 100% 700px; 4 | background-repeat: no-repeat; 5 | font-family: Tahoma; 6 | color: white; 7 | 8 | } 9 | .side-pan { 10 | margin: 0; 11 | border:0px; 12 | 13 | width:200px; 14 | padding: 5px 23px; 15 | margin:0px; 16 | -webkit-border-radius: 0px; 17 | -moz-border-radius: 0px; 18 | border-radius: 0px; 19 | border-bottom: 1px solid black; 20 | color: white; 21 | font-size: 20px; 22 | font-family: Georgia, serif; 23 | text-decoration: none; 24 | vertical-align: left; 25 | align:left; 26 | } 27 | div#left { 28 | width: 100%; 29 | height: 50px; 30 | float: left; 31 | } 32 | div#right { 33 | margin-left: 20%; 34 | height: 50px; 35 | color: white; 36 | font-size: 20px; 37 | font-family: Georgia, serif; 38 | } 39 | .main div { 40 | float: left; 41 | clear: none; 42 | } 43 | 44 | input { 45 | border : solid 2px ; 46 | border-color : black; 47 | BACKGROUND-COLOR: #444444; 48 | font: 8pt Verdana; 49 | color: white; 50 | } 51 | submit { 52 | BORDER: buttonhighlight 2px outset; 53 | BACKGROUND-COLOR: Black; 54 | width: 30%; 55 | color: #FFF; 56 | } 57 | #t input[type=\'submit\']{ 58 | COLOR: White; 59 | border:none; 60 | BACKGROUND-COLOR: black; 61 | } 62 | #t input[type=\'submit\']:hover { 63 | 64 | BACKGROUND-COLOR: #ff9933; 65 | color: black; 66 | 67 | } 68 | tr { 69 | BORDER: dashed 1px #333; 70 | color: #FFF; 71 | } 72 | td { 73 | BORDER: dashed 0px ; 74 | } 75 | .table1 { 76 | BORDER: 0px Black; 77 | BACKGROUND-COLOR: Black; 78 | color: #FFF; 79 | } 80 | .td1 { 81 | BORDER: 0px; 82 | BORDER-COLOR: #333333; 83 | font: 7pt Verdana; 84 | color: Green; 85 | } 86 | .tr1 { 87 | BORDER: 0px; 88 | BORDER-COLOR: #333333; 89 | color: #FFF; 90 | } 91 | table { 92 | BORDER: dashed 2px #333; 93 | BORDER-COLOR: #333333; 94 | BACKGROUND-COLOR: #191919;; 95 | color: #FFF; 96 | } 97 | textarea { 98 | border : dashed 2px #333; 99 | BACKGROUND-COLOR: Black; 100 | font: Fixedsys bold; 101 | color: #999; 102 | } 103 | A:link { 104 | border: 1px; 105 | COLOR: red; TEXT-DECORATION: none 106 | } 107 | A:visited { 108 | COLOR: red; TEXT-DECORATION: none 109 | } 110 | A:hover { 111 | color: White; TEXT-DECORATION: none 112 | } 113 | A:active { 114 | color: white; TEXT-DECORATION: none 115 | } -------------------------------------------------------------------------------- /www/dns-spoofing.php: -------------------------------------------------------------------------------- 1 |
6 | 7 | 8 | 11 | 14 | 15 | 18 |
9 | 10 | 12 | 13 | 16 | 17 |
19 |
'; 20 | 21 | if(isset($_POST['home'])) 22 | { 23 | 24 | echo '

This Lab is just to demonstrate how SSRF can be exploited to perform reading files/remote URLs'; 25 | 26 | } 27 | 28 | if(isset($_POST['load'])) 29 | { 30 | 31 | echo ' 32 | 33 |
34 |
Specify the file name:

35 | 36 |
37 | '; 38 | 39 | } 40 | if(isset($_POST['read'])) 41 | { 42 | 43 | 44 | $file=strtolower($_POST['file']); 45 | 46 | if(strstr($file, 'localhost') == false && preg_match('/(^https*:\/\/[^:\/]+)/', $file)==true) 47 | { 48 | 49 | $host=parse_url($file,PHP_URL_HOST); 50 | 51 | if(filter_var($host, FILTER_VALIDATE_IP)) 52 | { 53 | if(filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)== false) 54 | { 55 | 56 | echo ' 57 |
58 |
59 | The provided IP is from Private range and hence not allowed 60 | 61 |
62 | '; 63 | } 64 | else 65 | { 66 | echo '"; 67 | } 68 | } 69 | else 70 | { 71 | echo '"; 72 | } 73 | 74 | } 75 | 76 | elseif(strstr(strtolower($file), 'localhost') == true && preg_match('/(^https*:\/\/[^:\/]+)/', $file)==true) 77 | { 78 | echo ' 79 |
80 |
81 | Tyring to access Localhost o_0 ? 82 | 83 |
84 | '; 85 | } 86 | 87 | else 88 | { 89 | echo '"; 90 | } 91 | 92 | 93 | 94 | 95 | } 96 | 97 | if(isset($_POST['us'])) 98 | { 99 | echo ' 100 |
101 | 102 |

106 | --==[[Greetz to]]==--
Zero cool, code breaker ica, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba, Silent poison India, Magnum sniper, ethicalnoob Indishell, Local root indishell, Irfninja indishell
Reborn India, L0rd Crus4d3r, cool toad, Hackuin, Alicks, Gujjar PCP, Bikash, Dinelson Amine, Th3 D3str0yer, SKSking, rad paul, Godzila, mike waals, zoo zoo, cyber warrior, shafoon, Rehan manzoor
cyber gladiator,7he Cre4t0r, Cyber Ace, Golden boy INDIA, Ketan Singh, Yash, Aneesh Dogra, AR AR, saad abbasi, hero, Minhal Mehdi, Raj bhai ji, Hacking queen and rest of TEAM INDISHELL
107 | --==[[Love to]]==--
# My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP, 108 | Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Jagriti, Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)

109 | 110 | 111 |
112 | 113 | '; 114 | } 115 | 116 | ?> 117 | 118 | 119 | -------------------------------------------------------------------------------- /www/dns_rebinding.php: -------------------------------------------------------------------------------- 1 |

There was no host in your url!

"); } 8 | echo ' 9 |
Domain: - '.$host = $url_parts["host"].''; 10 | 11 | if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { 12 | $ip = $host; 13 | } else { 14 | $ip = dns_get_record($host, DNS_A); 15 | if (count($ip) > 0) { 16 | $ip = $ip[0]["ip"]; 17 | echo "
Resolved to IP: - {$ip}
"; 18 | 19 | } else { 20 | die("
Your host couldn't be resolved man...

"); 21 | } 22 | } 23 | 24 | foreach ($disallowed_cidrs as $cidr) { 25 | if (in_cidr($cidr, $ip)) { 26 | die("
That IP is a blacklisted cidr ({$cidr})!

"); // Stop processing if domain reolved to private/reserved IP 27 | } 28 | } 29 | 30 | 31 | echo "
Domain IP is not private, Here goes the data fetched from remote URL
"; 32 | echo "
"; 33 | 34 | } 35 | 36 | function in_cidr($cidr, $ip) { 37 | list($prefix, $mask) = explode("/", $cidr); 38 | 39 | return 0 === (((ip2long($ip) ^ ip2long($prefix)) >> $mask) << $mask); 40 | } 41 | 42 | 43 | echo ' 44 | --==[[ DNS Rebinding Attack ]]==-- 45 | 46 | 47 | 48 | 49 |
50 | 51 | #######################################################################################################################################################
52 | --==[[ DNS Rebinding SSRF Vulnerable Code ]]==--
53 | --==[[ With Love From Team IndiShell ]]==-- 54 |
55 |
57 | 58 | ####################################################################################################################################################### 59 |
61 | --==[[Greetz to]]==--
Zero cool, code breaker ica, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba, Silent poison India, Magnum sniper, ethicalnoob Indishell, Local root indishell, Irfninja indishell
Reborn India, L0rd Crus4d3r, cool toad, Hackuin, Alicks, Gujjar PCP, Bikash, Dinelson Amine, Th3 D3str0yer, SKSking, rad paul, Godzila, mike waals, zoo zoo, cyber warrior, shafoon, Rehan manzoor
cyber gladiator,7he Cre4t0r, Cyber Ace, Golden boy INDIA, Ketan Singh, Yash, Aneesh Dogra, AR AR, saad abbasi, hero, Minhal Mehdi, Raj bhai ji, Hacking queen and rest of TEAM INDISHELL
62 | --==[[Love to]]==--
# My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP, 63 | Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Jagriti, Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)
64 | 65 | 66 | 67 | 68 | ####################################################################################################################################################### 69 |
70 | 71 | 72 | '; 73 | 74 | echo '
75 | 76 | 77 | 80 | 83 |
78 | 79 | 81 | 82 |
84 |
'; 85 | 86 | if(isset($_POST['load'])) 87 | { 88 | 89 | echo ' 90 | 91 |
92 |
Specify the Remote file URL:

93 | 94 |
95 | '; 96 | 97 | } 98 | 99 | if(isset($_POST['read'])) 100 | { 101 | 102 | 103 | $file=strtolower($_POST['file']); 104 | 105 | if(strstr($file, 'localhost') == false && preg_match('/(^https*:\/\/[^:\/]+)/', $file)==true) 106 | { 107 | 108 | get_contents($file); 109 | 110 | } 111 | elseif(strstr(strtolower($file), 'localhost') == true && preg_match('/(^https*:\/\/[^:\/]+)/', $file)==true) 112 | { 113 | echo ' 114 |
115 |
116 | Dear Nigga, Trying to access Localhost o_0 ? 117 | 118 |
119 | '; 120 | } 121 | 122 | } 123 | 124 | ?> 125 | -------------------------------------------------------------------------------- /www/download.php: -------------------------------------------------------------------------------- 1 | alert('file not found');"; 23 | } 24 | 25 | } 26 | if(isset($_POST['download'])) 27 | { 28 | 29 | $file=trim($_POST['file']); 30 | 31 | file_download($file); 32 | 33 | } 34 | 35 | 36 | 37 | 38 | 39 | include('head.php'); 40 | 41 | echo '
42 | 43 | 44 | 47 | 50 | 51 | 54 |
45 | 46 | 48 | 49 | 52 | 53 |
55 |
'; 56 | 57 | if(isset($_POST['home'])) 58 | { 59 | 60 | echo '

This Lab is just to demonstrate how SSRF can be exploited when application has file download functionality'; 61 | 62 | 63 | } 64 | 65 | if(isset($_POST['load'])) 66 | { 67 | 68 | echo ' 69 | 70 |
71 |
Specify the file name to download:

72 | 73 |
74 | '; 75 | 76 | } 77 | 78 | 79 | if(isset($_POST['us'])) 80 | { 81 | echo ' 82 |
83 | 84 |

88 | --==[[Greetz to]]==--
Zero cool, code breaker ica, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba, Silent poison India, Magnum sniper, ethicalnoob Indishell, Local root indishell, Irfninja indishell
Reborn India, L0rd Crus4d3r, cool toad, Hackuin, Alicks, Gujjar PCP, Bikash, Dinelson Amine, Th3 D3str0yer, SKSking, rad paul, Godzila, mike waals, zoo zoo, cyber warrior, shafoon, Rehan manzoor
cyber gladiator,7he Cre4t0r, Cyber Ace, Golden boy INDIA, Ketan Singh, Yash, Aneesh Dogra, AR AR, saad abbasi, hero, Minhal Mehdi, Raj bhai ji, Hacking queen and rest of TEAM INDISHELL
89 | --==[[Love to]]==--
# My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP, 90 | Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Jagriti, Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)

91 | 92 | 93 |
94 | 95 | '; 96 | } 97 | 98 | 99 | 100 | ?> 101 | -------------------------------------------------------------------------------- /www/file_content_fetch/README.md: -------------------------------------------------------------------------------- 1 | # Application code fetch and disply the content of the specified file (file_get_contents.php) 2 | 3 | Exploitation Difficulty : Easy
4 | This is the simple example of Server-Side Request Forgery (SSRF) attack exploitation. Application code do not has any check for user input data and process it. 5 | 6 | Issue observation and exploitation scenario
In programming language, there are functions which can fetch the content of locally saved file. These functions may be capable of fetching the content from remote URLs as well (file_get_contents in PHP). 7 | This technique works if application is not prepending any string to the user supplied data to fetch the content from a file i.e 8 | application is not prepeding and directory name or path to the user supplied data. 9 | In this case, application data fetching function process the schemes like "http://" or "file://". 10 | When user will specify the remote URL in place of file name like "http://localhost", data fetching function extract the data from the specified URL. 11 | 12 | If application is prepending any data string (for example any directory name) to user data, in that case "http://" or "file://" scheme won't 13 | work and SSRF vulnerability exploitation is not possible. 14 | 15 | 16 | Vulnerable Script exploitation
17 | In this example, application has functionality to fetch and display the content of the file. 18 | Application has file "local.txt" hosted in the same directory where SSRF vulnerable code is hosted. 19 | 20 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/file_content_fetch/images/file1.png?raw=true) 21 | 22 | When user try to read the content of file saved on server, vulnerable code just check if file exist on server or not and display the content if file is present on server. 23 | 24 | Application is displaying the content of the file "local.txt" 25 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/file_content_fetch/images/file2.png?raw=true) 26 | 27 | Vulnerable code allow user to use "file://" scheme as well. For example, user can read file like "/etc/passwd" (Linux server) or "c:/windows/system32/drivers/etc/hosts" (in Windows server). 28 | 29 | Accessing Windows machine "host" entry file 30 | 31 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/file_content_fetch/images/file3.png?raw=true) 32 | 33 | Vulnerable code allowed user to access the content of "host" file 34 | 35 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/file_content_fetch/images/file4.png?raw=true) 36 | 37 | 38 |

Accessing the internal server URLs

39 | 40 | An attacker can exploit the vulnerable code not just to read the local file but can access the web application hosted on internal environment (in this case "localhost") 41 | 42 | User specified the URL "http://localhost/box.txt" which point to the file "box.txt" hosted on the local server. 43 | 44 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/file_content_fetch/images/file5.png?raw=true) 45 | 46 | Vulnerable code allowed user to access the HTTP content of the URL "http://localhost/box.txt" 47 | 48 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/file_content_fetch/images/file6.png?raw=true) 49 | 50 | ./Thanks 51 | -------------------------------------------------------------------------------- /www/file_content_fetch/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/file_content_fetch/images/file1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file1.png -------------------------------------------------------------------------------- /www/file_content_fetch/images/file2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file2.png -------------------------------------------------------------------------------- /www/file_content_fetch/images/file3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file3.png -------------------------------------------------------------------------------- /www/file_content_fetch/images/file4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file4.png -------------------------------------------------------------------------------- /www/file_content_fetch/images/file5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file5.png -------------------------------------------------------------------------------- /www/file_content_fetch/images/file6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/file_content_fetch/images/file6.png -------------------------------------------------------------------------------- /www/file_get_content.php: -------------------------------------------------------------------------------- 1 |
6 | 7 | 8 | 11 | 14 | 15 | 18 |
9 | 10 | 12 | 13 | 16 | 17 |
19 |
'; 20 | 21 | if(isset($_POST['home'])) 22 | { 23 | 24 | echo '

This Lab is just to demonstrate how SSRF can be exploited to perform reading files/remote URLs'; 25 | 26 | } 27 | 28 | if(isset($_POST['load'])) 29 | { 30 | 31 | echo ' 32 | 33 |
34 |
Specify the file name:

35 | 36 |
37 | '; 38 | 39 | } 40 | if(isset($_POST['read'])) 41 | { 42 | 43 | $file=trim($_POST['file']); 44 | 45 | echo htmlentities(file_get_contents($file)); 46 | 47 | } 48 | 49 | if(isset($_POST['us'])) 50 | { 51 | echo ' 52 |
53 | 54 |

58 | --==[[Greetz to]]==--
Zero cool, code breaker ica, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba, Silent poison India, Magnum sniper, ethicalnoob Indishell, Local root indishell, Irfninja indishell
Reborn India, L0rd Crus4d3r, cool toad, Hackuin, Alicks, Gujjar PCP, Bikash, Dinelson Amine, Th3 D3str0yer, SKSking, rad paul, Godzila, mike waals, zoo zoo, cyber warrior, shafoon, Rehan manzoor
cyber gladiator,7he Cre4t0r, Cyber Ace, Golden boy INDIA, Ketan Singh, Yash, Aneesh Dogra, AR AR, saad abbasi, hero, Minhal Mehdi, Raj bhai ji, Hacking queen and rest of TEAM INDISHELL
59 | --==[[Love to]]==--
# My Father, my Ex Teacher, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP, 60 | Mohit, Ffe, Ashish, Shardhanand, Budhaoo, Jagriti, Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)

61 | 62 | 63 |
64 | 65 | '; 66 | } 67 | 68 | ?> -------------------------------------------------------------------------------- /www/head.php: -------------------------------------------------------------------------------- 1 | 6 | 7 | 8 | 9 | --==[[IndiShell Lab]]==-- 10 | 11 | 128 | 139 | '; 140 | 141 | echo $head ; 142 | 143 | echo ' 144 | 145 | 146 |
147 | 148 | ####################################################################################################################################
149 | --==[[ SSRF Vulnerable Lab]]==--
150 | --==[[ With Love From Team IndiShell]]==-- 151 |
152 |
154 | 155 | ####################################################################################################################################
156 | 158 | 159 | 160 | 161 |
162 | '; 163 | ?> 164 | -------------------------------------------------------------------------------- /www/images/README.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /www/images/SSRF_Vulnerable_Lab.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/SSRF_Vulnerable_Lab.png -------------------------------------------------------------------------------- /www/images/head.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/head.jpg -------------------------------------------------------------------------------- /www/images/indishell.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/indishell.jpg -------------------------------------------------------------------------------- /www/images/matrix2.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/matrix2.gif -------------------------------------------------------------------------------- /www/images/ssrf_lab.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/ssrf_lab.gif -------------------------------------------------------------------------------- /www/images/who.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/images/who.jpg -------------------------------------------------------------------------------- /www/index.php: -------------------------------------------------------------------------------- 1 | 2 | 49 | 50 | 66 | 67 | 68 |
--==[[ Welcome to the SSRF Vulnerable Lab ]]==--
69 |
70 | Exercises: 71 |
72 | 74 | 82 |
73 | 1. Application code fetch and disply the content of the specified file: -
75 | 77 | 78 |
Link to Vulnerable Script - file_get_content.php
83 |

84 | 85 | 87 | 99 |
86 | 2. Application provide interface to connect to Remote Host : -
88 | 90 | 91 | 98 |
100 | Link to Vulnerable Script - sql_connect.php
101 |

102 | 103 | 105 | 114 |
104 | 3. Application has File Download Functionality: -
106 | 108 | 109 |
Link to Vulnerable Script - download.php 115 |
116 |

117 | 119 | 128 |
118 | 4. Bypassing IP blacklisting using DNS Based Spoofing: -
120 | 122 | 123 |
Link to Vulnerable Script - dns-spoofing.php
129 |

130 | 131 | 133 | 141 |
132 | 5. Bypassing IP blacklisting using DNS Rebinding Technique: -
134 | 136 | 137 |
Link to Vulnerable Script - dns_rebinding.php
142 | 143 | 144 |

145 | 147 | 156 |
146 | 6. SSRF in HTML to PDF generator: -
148 | 150 | 151 | 152 |
Link to Vulnerable Script 1 - pdf_ssrf_weasyprint.php
Link to Vulnerable Script 2 - pdf_ssrf_wkhtmltopdf.php
157 | -------------------------------------------------------------------------------- /www/local.txt: -------------------------------------------------------------------------------- 1 | This is just dummy text file xD

hi -------------------------------------------------------------------------------- /www/pdf_generator/images/README.md: -------------------------------------------------------------------------------- 1 | This directory contain the POC images for SSRF exploitation in "Weasyprint" and "WKHTMLtoPDF" HTML to PDF converter vulnerable scripts. 2 | -------------------------------------------------------------------------------- /www/pdf_generator/images/w1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/w1.png -------------------------------------------------------------------------------- /www/pdf_generator/images/w2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/w2.png -------------------------------------------------------------------------------- /www/pdf_generator/images/w3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/w3.png -------------------------------------------------------------------------------- /www/pdf_generator/images/w4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/w4.png -------------------------------------------------------------------------------- /www/pdf_generator/images/w5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/w5.png -------------------------------------------------------------------------------- /www/pdf_generator/images/wk1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/wk1.png -------------------------------------------------------------------------------- /www/pdf_generator/images/wk2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/wk2.png -------------------------------------------------------------------------------- /www/pdf_generator/images/wk3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/wk3.png -------------------------------------------------------------------------------- /www/pdf_generator/images/wk4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/incredibleindishell/SSRF_Vulnerable_Lab/7b9a3a1caf7fab5904232478dd41c62a166376a3/www/pdf_generator/images/wk4.png -------------------------------------------------------------------------------- /www/pdf_generator/readme.md: -------------------------------------------------------------------------------- 1 | # 1.0 SSRF in HTML to PDF converter functionality 2 | 3 | Exploitation Difficulty: Easy
4 | 5 | These are the SSRF scenario based on the fact that when web application accepting the user user input, placing them in HTML and pass the HTML code to "HTML to PDF generator". 6 |

When HTML code will be processed by the "HTML to PDF generator", HTML code will be evaluated to corresponding representation of that HTML code in web browser. 7 |
In this case, if attacker supplied data is not getting senitized or filtered before placing it to HTML code, attacker can trick "HTML to PDF generator" software to access the internal Hosts/domains. 8 | 9 | We have scenarios of 2 "HTML to PDF generator" which allow an attacker to exploit SSRF vulnerability if web application is passing the untrusted user supplied data to HTML code. 10 |
These "HTML to PDF generator" are: 11 | 12 | 1. Weasyprint 13 | 2. wkhtmltopdf 14 | 15 |
pdf_ssrf_weasyprint.php is vulnerable script which is using weasyprint. 16 |
pdf_ssrf_wkhtmltopdf.php is vulnerable script which is using wkhtmltopdf. 17 | 18 | 1.1 System Requirements: 19 | 20 | 1. Weasyprint and wkhtmltopdf converter must be installed on the machine. 21 | 2. Web server with PHP support 22 | 23 | 1.2.1 Linux based setup: wkhtmltopdf 24 |
No change is required. This script is developed to work on Linux OS. 25 | 26 | 1.2.2 Windows based setup: 27 |
Below mentioned changes will be required: 28 | 29 | 30 | Remove comment syntax from the line no "271" and "272" and make them like this 31 | 32 | $path_pdf_converter='C:\Program Files\wkhtmltopdf\bin\wkhtmltopdf.exe'; /*remove the comment if you want to use it on Windows machine*/ 33 | passthru('"'.$path_pdf_converter.'" -T 0 -R 0 -B 0 -L 0 --orientation Portrait --page-size A4 sample.html output4.pdf'); /*remove the comment if you want to use it on Windows machine*/ 34 | 35 | Comment out the the line number 273 like this 36 | 37 | //passthru('xvfb-run wkhtmltopdf -T 0 -R 0 -B 0 -L 0 --orientation Portrait --page-size A4 --quiet sample.html output4.pdf 2>&1'); 38 | 39 | 1.3 Installation 40 | 41 | wkthmltopdf 42 | 43 | sudo apt-get update 44 | sudo apt-get install xvfb libfontconfig wkhtmltopdf 45 | 46 | weasyprint 47 | 48 | As per the OS, follow steps from below mentioned URL to install the weasyprint: 49 | 50 | https://weasyprint.readthedocs.io/en/stable/install.html 51 | 52 | 53 | # 2.0 Exploitation 54 | 55 | 56 | Let's start with exploitation and possible attack vectors to perform SSRF. 57 | 58 | 2.1 SSRF in Weasyprint HTML to PDF generator 59 | 60 | Web application accepting user input via GUI.
61 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/w1.png?raw=true) 62 | 63 | Accepted the user input, placed it inside the HTML code and generated PDF by rendering the HTML code 64 | 65 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/w2.png?raw=true) 66 | 67 | After observing such behavior, try with following payloads to confirm whether web application code is vulnerable: 68 | 69 |

test

70 | 71 | 72 | If web application is processing the above mentioned payloads, go for below mentioned payloads to exploit SSRF. 73 | 74 | Payloads 75 | 76 | To grab the data from HTTP based URL, use below mentioned style payload 77 | 78 | 79 | 80 | To grab the data from internal file system, use below mentioned style payload 81 | 82 | 83 | 84 | 2.1.1 Exploiting the SSRF - Google Cloud Metadata endpoint access 85 | 86 | Let's assume, web application is hosted inside the Google Cloud Platform. Now, try to grab the data from Google Cloud internal Metadata endpoint. 87 | I saved sample username and password during the creation of the Virtual machine which are accessible on below mentioned URL: 88 | http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes 89 | 90 | Below mentioned payload will grab and attach the HTTP response from the above metnioned Metadata URL to PDF: 91 | 92 | 93 | 94 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/pdf_generator/images/w3.png?raw=true) 95 | 96 | Open the generated PDF and observe, nothing is there in customer name column. Download the generated PDF file to extract the data from it. 97 | 98 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/w4.png?raw=true) 99 | 100 | Extract the attached content from the downloaded PDF file using this Python Script developed by Ben AKA Nahamsec. 101 | 102 | python script.py downloaded_file.pdf 103 | 104 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/w5.png?raw=true) 105 | 106 | And Python script extracted the attached HTTP response from the Internal Metadata URL. 107 | 108 | This is how an attacker can extract the HTTP response from other internal IPs/Hosts. 109 | 110 | 2.2 SSRF in wkhtmltopdf, HTML to PDF generator 111 | 112 | An attacker can exploit SSRF in web application using wkhtmltopdf to generate the PDF from HTML having untrusted user supplied data placed in it. 113 | 114 | Web application is accepting user supplied data 115 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/wk1.png?raw=true) 116 | 117 | Generated PDF has user supplied data. 118 | ![](https://github.com/incredibleindishell/SSRF_Vulnerable_lab/blob/master/www/pdf_generator/images/wk2.png?raw=true) 119 | 120 | Payload to load internal app rendered HTTP response inside the PDF using 123 | 124 | Payload to access the web page which has "X-Frame-Options" header in HTTP response and can not be loaded inside the