Hi all, I hope all is well. I'm going to talk about the SSRF I found a long time ago. That was really easy finding. Let's get started 🐱💻
Now, I'll talk about my recon process for programs which have big scopes. Let's talk about for *.anywebsite.com. Listen, of course recon is important but if you focus on your target you can find more juicy things. I'll use 5 tools for my all recon process.
GitHub - projectdiscovery/subfinder: Subfinder is a subdomain discovery tool that discovers valid…
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework…
GitHub - lc/gau: Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and…
getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl for…
GitHub - projectdiscovery/httpx: httpx is a fast and multi-purpose HTTP toolkit allows to run…
httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is…
GitHub - GerbenJavado/LinkFinder: A python script that finds endpoints in JavaScript files
A python script that finds endpoints in JavaScript files - GitHub - GerbenJavado/LinkFinder: A python script that finds…
GitHub - ffuf/ffuf: Fast web fuzzer written in Go
A fast web fuzzer written in Go. ffuf has a channel at Porchetta Industries Discord server alongside of channels for…
Get subdomains of target. Use httpx to extract subdomains which is up. After this, use gau to fetch urls of subdomains. Then filter some extensions and use httpx again for this urls. Like .php .aspx .jsp .js etc. If url return 200 that's our target. Now we're ready to fuzz and find some new endpoints from this url. At this step, use ffuf and linkfinder. I like the manual search better.
Server Side Request Forgery with huge impact
I found redacted.com/x/y/z/anything.php that was very clear php page. Then I used ffuf to fuzz this directory redacted.com/x/y/z/FUZZ I found crossdomain.php in the same directory and page was require a url parameter. This page was pulling the site in the url parameter directly and showing it on the page. Damn server pulling everything without any protection, filter etc. When the server makes a request and if you can interfere with it, you think of SSRF. After that I tried known methods. For attack vectors -> . Let's take a look.
or anyfile -> XSS
file:///proc/version
file:///etc/passwd
http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-default
Almost 1 year ago. Sometimes you'll find easy bug with huge impact like this. Sometimes you'll try to bypass very hard filters. Keep reading, keep learning :)
Thank you. Happy hunting :)
Follow me on :)