Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/machadootto/sap_bo_launchpad-ssrf-timing_attack
ReconnaissanceVulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubmachadootto/sap_bo_launchpad-ssrf-timing_attack

sap_bo_launchpad-ssrf-timing_attack

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
1232 years agoNot yet reviewed

About

This script exploits and performs an SSRF (Server-Side Request Forgery) and Timing Attack against the SAP BusinessObjects Launchpad (CVE-2020-6308). It attempts to determine the status of various ports on a target IP address by measuring the response time of the application when attempting to authenticate against it.

Share

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC

This Python script is a proof-of-concept (PoC) for executing SSRF (Server-Side Request Forgery) and Timing Attacks against SAP BusinessObjects Launchpad. It is designed to help security researchers and professionals identify open ports on a target IP by leveraging SAP BusinessObjects' authentication mechanisms.

Features

  • SSRF Exploit: Leverages SSRF to interact with internal services by targeting different ports on a specified IP address.
  • Timing Attack: Measures the time taken by the SAP BusinessObjects server to respond to authentication attempts, allowing you to infer the status of targeted ports.
  • Customizable Ports: Allows you to specify a list of ports to target, or you can use the default set of common ports.

Requirements

  • Python 3.x

Installation

Clone the repository and navigate to the project directory:

root@kitploit:~
git clone https://github.com/MachadoOtto/sap_bo_launchpad-ssrf-timing_attack.git
cd sap_bo_launchpad-ssrf-timing_attack

Usage

root@kitploit:~
./sap_bo_launchpad-ssrf-timing_attack.py <affected_url> <targetIP> [targetPorts]
  • affected_url: The URL of the SAP BusinessObjects Launchpad instance you want to test.
  • targetIP: The IP address you want to probe for open ports.
  • targetPorts (optional): A comma-separated list of ports to check (e.g., 22,80,443). If not specified, a default set of ports will be used.

Legal Disclaimer

This script is intended for educational purposes only and should only be used in environments where you have explicit permission to conduct security testing. Unauthorized use of this script against targets without consent is illegal and unethical.

Download Tool