Comment on page

Finding SSRF (all scope)

The goal of this laboratory is to use some tools to collect all subdomains from a specific domain, all the URLs and parameters, and retrieve some results using the burp collaborator utility.
Tools
​subfinder - subdomain discovery.
How to install it:
GO111MODULE=on go get -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder
 qsreplace - Accept URLs on stdin, replace all query string values with a user-supplied value.
How to install it:
go get -u github.com/tomnomnom/qsreplace

 gau: Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
How to install it:
GO111MODULE=on go get -u -v github.com/lc/gau

 waybackurls: Fetch all the URLs that the Wayback Machine knows about for a domain.
How to install it:
go get github.com/tomnomnom/waybackurls
 gf: A wrapper around grep, to help you grep for things.
How to install it:
go get -u github.com/tomnomnom/gf
List to exclude:
grep -v "\.css?ver" | grep -v "\.js" | grep -v "\.png" | grep -v "\.woff" | grep "collaborator"
 ffuf: Fast web fuzzer written in Go.
How to install it:
go get -u github.com/ffuf/ffuf
Scope
In Scope: *.example.com
Harvester
gau -subs example.com; subfinder -d example.com -silent | waybackurls | sort -u > output.txt
Replacing params
cat output.txt | qsreplace "http://xxxxxxxxxxx.burpcollaborator.net" >> fuzz_list.txt
Fuzzing and test
ffuf -c -w fuzz_list.txt -u FUZZ -t 200 -r
Resources
To collect all URLs from several sources:
GitHub - signedsecurity/sigurlfind3r: A passive reconnaissance tool for known URLs discovery - it gathers a list of URLs passively using various online sources.
GitHub
​

Server Side Template Injection (SSTI)

Format String Exploitation

Last modified 2yr ago