SSRF with advanced bypass techniques and protocol support
This lab demonstrates advanced SSRF vulnerabilities with multiple protocol support and bypass techniques. The application supports various protocols and encoding methods that can be exploited to bypass security controls.
Objective: Use advanced SSRF techniques to bypass filters and access internal services through various protocols and encoding methods.
// Handle advanced SSRF request
if (isset($_GET['url']) && !empty($_GET['url'])) {
$url = $_GET['url'];
// Apply bypass technique
$url = applyBypass($url, $bypass_technique);
// Vulnerable: No validation of URL or protocol
try {
$context_options = [
'http' => [
'timeout' => 10,
'user_agent' => 'AdvancedSSRF/1.0',
'follow_location' => true,
'max_redirects' => 10
]
];
// Support different protocols
if ($protocol === 'gopher') {
$context_options['http']['method'] = 'GET';
$context_options['http']['header'] = "Content-Type: application/x-www-form-urlencoded\r\n";
}
$context = stream_context_create($context_options);
$response = file_get_contents($url, false, $context);
if ($response !== false) {
// Display response content
}
} catch (Exception $e) {
// Error handling
}
}
// Example vulnerable usage:
// ?url=http://localhost:8080&protocol=http&bypass=none
// ?url=file:///etc/passwd&protocol=file&bypass=null_byte
// ?url=gopher://localhost:3306&protocol=gopher&bypass=double_encoding
urlTry these advanced payloads:
http://localhost:8080 - Basic local servicefile:///etc/passwd - Local file accessgopher://localhost:3306 - Database via Gopherdict://localhost:11211 - Memcached via Dicthttp://169.254.169.254/ - Cloud metadataBypass Techniques:
double_encoding - Double URL encodingunicode_encoding - Unicode encodingnull_byte - Null byte injectionredirect - HTTP redirect bypassThis lab supports various bypass techniques:
%252f instead of %2f%c0%af instead of /%00 to terminate stringsThis lab supports various protocols:
Click these links to test advanced techniques: