Python - Server Side Request Forgery (SSRF)
Running the app on Docker
Now that the app is running let's go hacking!
Reconnaissance
Server Side Request Forgery (SSRF) attack, where an attacker abuse the functionality of a vulnerable web application to send crafter request which which read or update internal resources. Attacker can attack an internal network or application behind the firewall with this attack which is normally not accessible through external network and even attack the internal network web applications.
SSRF attack can be used to make requests to other internal resources for accessing the metadata and to run a port can on the internal network. URL schema such as file:// can be used to read the file from the server. Attackers can use legacy URL schemas such as dict, gopher, expect etc which can even cause remote code execution.
First lets see what type of services are open on the server that we try to attack.
So as we confirmed the only open port is 5000. Now lets have a look at the application.
Here we have a keep alive functionality where we can verify different website's if they are alive and reachable. Lets try with google.com
Exploitation
The keep alive functionality was intended to be used for external websites but we can abuse it to also check for internal IP addresses and enumerate services. Lets try a known port like for example 3306 a Mysql service, maybe this is running on the server?
Success! As we observed, we have found an Mysql service running locally.
Yes it was having a Mysql service running on the local listner 127.0.0.1 and that is why our Nmap scan didn't found it but with the SSRF vulnerability in the application we can find it.
Also there is another service running, find a way to automatically enumerate all the possible services and find the last one.
Additional sources
Last updated
Was this helpful?
