Skip to content

Supported Tools

Jump to bottom
Brendan Coles edited this page May 30, 2016 · 7 revisions

The tools in this section are known to work with SSRF Proxy.

SSRF Proxy supports the HTTP CONNECT verb. SSL tunneling is not supported.

For best results, ensure SSRF Proxy is configured with the following options, where possible:

  • --match=REGEX
  • --guess-status
  • --guess-mine
  • --forward-cookies
  • --body-to-uri
  • --auth-to-uri

curl

$ curl -isk -x http://127.0.0.1:8081/ http://127.0.0.1/

$ curl -isk -x http://127.0.0.1:8081/ http://127.0.0.1/ --proxytunnel

Note the trailing / slash is required for old versions of cURL.

proxychains

Set SSRF Proxy as the proxy in proxychains.conf :

[ProxyList]
http 127.0.0.1 8081

Also disable DNS lookups in proxychains.conf :

# Proxy DNS requests - no leak for DNS data
#proxy_dns

Preface commands with proxychains :

$ proxychains curl -isk http://127.0.0.1/

Web Browser

Set the web browser proxy to SSRF Proxy as a HTTP proxy.

Note that rendering of assets within a browser (images, stylesheets, etc) will fail unless the --guess-mime option is supplied. Additionally, an accurate regex must be supplied to the --match option.

Additionally, stripping unwanted headers such as content-disposition is often desirable - --strip "content-disposition"

wget

$ export http_proxy=http://127.0.0.1:8081/
$ wget --mirror --no-check-certificate --convert-links --adjust-extension --page-requisites --no-parent http://127.0.0.1/bWAPP/

sqlmap

sqlmap can be used to exploit SQL injection vulnerabilities through SSRF Proxy.

$ sqlmap -u "http://sqli.example/query.php?query=test" --proxy "http://127.0.0.1:8081" --dbms mysql -p query --technique BT --banner

Using --hex and --technique BT (blind time-based) may provide better results.

Note that tweaking the --timeout option (default: 10 seconds) for SSRF Proxy may be necessary if a large number of timeouts are encountered.

nmap

You may be able to perform TCP port scanning with nmap using the TCP connect() scan technique (-sT) in combination with proxychains.

$ proxychains nmap -sT -p <PORTS> 127.0.0.1

Note that this will likely result in false negatives if the remote service does not hang-up immediately, resulting in a timeout. MySQL, for example, is unlikely to close the connection after receiving invalid input. Check the SSRF Proxy output for Timeout errors to verify.

nmap OS detection and UDP scanning does not work through HTTP proxies and will not work through SSRF Proxy.

Metasploit

> use auxiliary/scanner/http/title 
> set proxies http:127.0.0.1:8081 
> set rhosts 127.0.0.1
> set targeturi /phpmyadmin 
> run

Arachni

$ arachni --http-proxy 127.0.0.1:8081 "http://127.0.0.2/"

Note that Arachni cannot scan 127.0.0.1; instead 127.0.0.2 is used.

nikto

Set SSRF Proxy as the proxy in nikto.conf :

# Proxy settings -- still must be enabled by -useproxy
PROXYHOST=127.0.0.1
PROXYPORT=8081

Run nikto :

$ nikto.pl -host 127.0.0.1 -useproxy

Note that nikto may identify a large number of false positives if the SSRF server has PHP errors enabled.

WhatWeb

WhatWeb can be used to fingerprint web servers and applications.

$ whatweb --proxy 127.0.0.1:8081 http://127.0.0.1/

Clone this wiki locally