SSRFmap - 自动SSRF引信和开采工具

项目说明

SSRFmap ![CI]() ![Python 3.12+]() ![Rawsec's CyberSecurity In]()

SSRF are often used to le actions on other services, this 框架 aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz.

> 服务端 Side Request Forgery or SSRF is a in which an attacker forces a 服务端 to perform requests on their behalf.

Summary

* Install and Manual
* Modules
* Examples
* SSRFmap - Tests
* Contribute
* Roadmap
* Contributors

Install and Manual

Github

Docker

Modules

The following modules are already implemented and can be used with the -m argument.

| Name | Description |
| :------------- | :------------------------------------------------------- |
| axfr | DNS zone transfers (AXFR) |
| fastcgi | FastCGI RCE |
| redis | Redis RCE |
| github | Github Enterprise RCE < 2.8.7 |
| zabbix | Zabbix RCE |
| mysql | MySQL Command execution |
| postgres | Postgres Command execution |
| docker | Docker Infoleaks via API |
| smtp | SMTP send mail |
| portscan | Scan top 8000 ports for the host |
| networkscan | HTTP Ping sweep over the 网络 |
| readfiles | Read files such as /etc/passwd |
| alibaba | Read files from the provider (e.g: meta-data, user-data) |
| aws | Read files from the provider (e.g: meta-data, user-data) |
| gce | Read files from the provider (e.g: meta-data, user-data) |
| digitalocean | Read files from the provider (e.g: meta-data, user-data) |
| socksproxy | SOCKS4 Proxy |
| smbhash | Force an SMB authentication via a UNC Path |
| tomcat | Bruteforce attack against Tomcat Manager |
| custom | Send custom data to a listening service, e.g: netcat |
| memcache | Store data inside the memcache instance |

Examples

First you need a request with a parameter to fuzz, Burp requests works well with SSRFmap.
They should look like the following. More examples are a in the ./examples folder.

Use the -m followed by module name (separated by a , if you want to launch several modules).

If you want to inject inside a header, or a GET, POST, or PUT parameter, specify its name:

By default, SSRFmap replaces the selected parameter's complete value. To keep part of the saved
value, place *FUZZ* exactly where the payload should be inserted:

Using -p url preserves test; and ;end, replacing only *FUZZ* with each payload. The
marker works in GET parameters, headers, POST or PUT bodies, JSON, XML, and multipart form fields.

If you need to have a custom user-agent use the --uagent. Some targets will use HTTPS, you can enable it with --ssl.

Some modules allow you to create a connect back, you have to specify LHOST and LPORT. Also SSRFmap can listen for the incoming reverse shell.

When the target is protected by a WAF or some filters you can try a wide range of payloads and encoding with the parameter --level.

SSRFmap Tests

Run the automated unit tests and lint checks with:

A quick way to test the 框架 can be done with data/example.py SSRF service.

Local

Retrie and cloud metadata are sa loot/<target>/. The loot/ directory is
ignored by Git and must not be committed.

Docker

Contribute

I :heart: pull requests :)

Roadmap

Feel free to add any feature listed below or a new service:

You can also contribute with a beer IRL or Sponsor button.

Thanks to the contributors

<p align="center">
<a href="
<img src="
</a>
</p>

Inspired by

项目信息

开发语言：Python

Star 数：3629

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automatic SSRF fuzzer and exploitation 工具展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。