SSRF_Vulnerable_Lab - This Lab contain the sample codes which are vulner

项目说明

Ser Request Forgery (SSRF) Lab

This repository contain PHP codes which are to Ser Request Forgery (SSRF) attack.

I would like to say Thank You to , AKReddy, Vivek Sir (For being great personalities who always supported me), Andrew Sir - @ (for his encouraging words) and those researchers who contirubuted in DNS rebinding attack based research

![]()

codes are meant to demonstrate SSRF for below mentioned 5 scenarios:

<b> 1. Application code that fetches and display the content of the specified file</b>

In programming languages, there are functions which can fetch the contents of locally saved file. These functions may be capable of fetching the content from remote URLs as well local files (e.g file_get_contents in PHP).

This functionality can be abused if application is not prepending any string to the user supplied data to fetch the content from a file i.e application is not prepeding and directory name or path to the user supplied data.

In this case, these data fetching function can process the schemes like " or "file://". When user specifies the remote URL in place of file name like " the data fetching function extract the data from the specified URL.

In case if application is prepending any data string (for example any directory name) to user data, " or "file://" scheme won't work and exploitation of SSRF is not possible.

<a href=" to Exploitation of Scenario 1</a>

<b> 2. Application provides interface to connect to Remote Host</b>

Web application has interfaces that allow an user to specify the any IP with any port. Here the application has functionality which tries to connect to service like "MySQL", "LDAP" etc.

Application expects user to specify the remote ser/IP, username and password in input fields. Application then tries to connect to the remote server o port. Here in this scenario, application tries to communicate to remote service listening on specific port. When code has functionality to connect to server like MySQL and user specified the SMB port, application will try to communicate to SMB ser MySQL ser packets. E, the port is open, we are not able to communicate to the service due to difference in way of communication.

This behaviour can be exploited to perform internal network scanning not just to enumerate IPs but Ports as well on those live IPs.

<a href=" to Exploitation of Scenario 2</a>

<b> 3. Application with File Download Functionality</b>

In this case, an attacker can exploit this functionality to perform IP scanning inside the network where application server is hosted.
The function which performs the task of downloading file from server, can download file not just from local server but also from SMB path as well. This is something which can help an attacker to figure out the Windows based machines in the network.

Web application hosted on Windows OS will process the SMB path as well if file download functionality is processing user input without prepending any data.

<a href=" to Exploitation of Scenario 3</a>

<b> 4. Bypassing IP blacklisting using DNS Based Spoofing</b>

The script has funcionality which allow user to fetch data from remote URL. User need to specify the remote URL with any IP or domain name.

The script perform check if user has specified the input as "localhost", "Internal IPs" or "Reserved IPs". If domain/IP specified by user is blacklisted, script will not fetch the content and stop processing.

<a href=" to Exploitation of Scenario 4</a>

<b> 5. Bypassing IP blacklisting using DNS Rebinding Technique</b>

Application has implemented black listing of not just internal and private range IPs but also rsolve the user supplied domain to its IP and again perform check if resolved is black listed or not.

In this case, DNS based spoofing trick will also not work to access the content hosted on internal/Reserved IP. Application code perform domain resolution to its IP and again perform black listed IP check for the resolved IP.

<a href=" to Exploitation of Scenario 5</a>

<b> 6. SSRF in HTML to PDF generator script</b>

This the scenrio of the web app which is using HTML to PDF generator script and passing untrusted user supplied data to HTML file which is processed by HTML to PDF generator.

<a href=" to Exploitation of Scenario 6</a>

Ofcourse,<br><b>--==[[ With Love From IndiShell ]]==--</b> <img src="

--==[[ Greetz To ]]==--

Guru ji zero, Code breaker ICA, root_devil, google_warrior, INX_r0ot, Darkwolf indishell, Baba,
Silent poison India, Magnum sniper, ethicalnoob Indishell, Reborn India, L0rd Crus4d3r, cool toad,
Hackuin, Alicks, mike waals, cyber gladiator, Cyber Ace, Golden boy INDIA, d3, rafay baloch, nag256
Ketan Singh, AR AR, saad abbasi, Minhal Mehdi, Raj bhai ji, Hacking queen, lo, D2, Bikash Dash and rest of the Team INDISHELL

--==[[Love to]]==--

My Father, my Ex Teacher, Lovey, cold fire hacker, Mannu, ViKi, Ashu bhai ji, Soldier Of God, Bhuppi, Gujjar PCP
Mohit, Ffe, Shardhanand, Budhaoo, Hacker fantastic, Jennifer Arcuri, Thecolonial, Anurag Bhai Ji and Don(Deepika kaushik)

Docker

There is a Dockerfile in this repo that will spin up a docker image.
To build it, simply run docker build -t <tag> ..
The Apache server is running on port 80 inside the container.
Expose it with the -p flag.
Running it with docker run -p 9000:80 <tag> will bring up a container listening on localhost:9000.

项目信息

开发语言：PHP

Star 数：794

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。