daeken / ssrftest

SSRF testing tool

Welcome to SSRFTest

Installation

1. Clone the repo
2. Generate a random 64-byte ASCII string (I typically just run import random; ''.join('%02x' % random.randrange(256) for i in xrange(32)) at the Python interpreter)
3. Put that string into main.py on the line app.secret_key = key = 'SECRET HERE'
4. (Optional) Change the database password in docker-compose.yml and model.py -- default is dbpassword. This is not exposed to the outside so it's largely irrelevant
5. Search for ssrftest.com and replace it with the IP/domain you're hosting this on
6. Install Docker and Docker Compose
7. Run ./build-docker.sh
8. Run docker-compose up
9. ???
10. Profit

ssrftest's Issues

FAILS in UBUNTU

when running on ubuntu latest
web_1 | 2023-04-05 15:45:17,119 INFO exited: uwsgi (exit status 22; not expected)
web_1 | 2023-04-05 15:45:18,121 WARN received SIGTERM indicating exit request
web_1 | 2023-04-05 15:45:18,122 INFO waiting for nginx, quit_on_failure to die
web_1 | 2023-04-05 15:45:18,148 INFO stopped: nginx (exit status 0)
web_1 | 2023-04-05 15:45:18,149 INFO stopped: quit_on_failure (terminated by SIGTERM)

i think its a uwsgi issue

Simplify Setup

A script to do the steps in the readme -- setting up a secret key, updating the hostname/IP for the generated target scripts and such -- would be a big help for simplifying setup of the tool.

Add SVG XXE/Image Reference Support

SSRFTest currently supports exploitation of a number of different target scenarios, but this would be a helpful addition.

HELP - Running outside of Docker

Hi There,

I am trying to get this app running on a Nginx server already on a Raspi,

The docker images aren't compatible for some reason as I keep getting exec format errors,

Therefore, I install all the python modules needed to run the app proxied through Nginx

However, every time I go to run the main.py script I get this error

sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not connect to server: Connection timed out
Is the server running on host "db" (160.83.8.143) and accepting
TCP/IP connections on port 5432?

I have no idea where this IP Address is coming from and it seems to be mapped to the domain www.db.com

Is there a way I can change this, I suspect it is something to do with the metadata.py script?

Write Copy for Home Page

Right now the home page doesn't tell you anything about what the app is, how to use it, etc.

Upgrade to Python 3

Boring first issue, but I'm happy to contribute to this cause. Python 2 is way deprecated now (there's even an app for the countdown), so might as well upgrade before EOL.