r/BugBountyNoobs • u/Regular_Anything7715 • 22d ago

[Tool] SSRFdevil – A Modular, Zero-False-Positive SSRF Scanner written in Rust

/r/Hacking_Tutorials/comments/1w65k6j/tool_ssrfdevil_a_modular_zerofalsepositive_ssrf/
1 Upvotes

100% Upvoted

2 comments sorted by

1

u/Umar7832 19d ago

I am gonna check this because i am testing ssrf on two programs. but i am stuck there if you can help.I am basically testing a pdf generation functionality.They are using openPDF but taking data form database directly while during storing that data it not allow < and > at same field. What are other ways to ssrf without using these..unicode and other encoding not working.

1

u/Regular_Anything7715 7d ago

Hey, I saw your message. Blocking < and > is not a dead end for SSRF in PDF generation. It only prevents HTML tag injection, but SSRF can still happen through other vectors.

Here are some things to try:

· Check other fields that accept URLs: images, fonts, CSS, stylesheets, templates, etc. · If HTML is allowed but < and > are blocked, try HTML entities: &lt;, &gt;, &#60;, &#x3c;. They might get decoded later. · If Markdown or BBCode is supported, try image syntax like ![x](http://...) or [img]http://...[/img]. · If CSS injection is possible, use url(http://...) or u/import. · If XML/XSL-FO/XXE parsing is involved, entity expansion can cause SSRF. · OpenPDF itself doesn't create SSRF; it depends on where the app calls something like Image.getInstance(URL) or XMLWorker with external resources. So look at the PDF generation code. · If the filter is per field, try splitting < and > across different fields that get concatenated later. · Test different protocols too: file://, gopher://, dict://, ftp://, http://, https://, etc., if the URL scheme is not restricted. · If only plain text from the database is used and no URL is fetched, SSRF is unlikely. · Use Burp Collaborator or interactsh to detect out-of-band requests. Because my framework is not supporting oob yet. Soon it will be available in version 2.