ssrf-example/app.py at main · HackTricks-Training/ssrf-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
from flask import Flask, request
import requests
from flask_httpauth import HTTPBasicAuth
import os


app = Flask(__name__)
auth = HTTPBasicAuth()

USERNAME = os.environ.get('SSRF_USERNAME', 'admin')
PASSWORD = os.environ.get('SSRF_PASSWORD', 'hacktricks')
PORT = int(os.environ.get('SSRF_PORT', '45380'))

def ssrf_html(text=""):
    return '''
    <html>
        <head>
            <title>SSRF Demo</title>
            <style>
                body {
                    font-family: Arial, sans-serif;
                    margin: 0;
                    padding: 0;
                    display: flex;
                    flex-direction: column;
                    align-items: center;
                    justify-content: center;
                    height: 100vh;
                    background-color: #f9f9f9;
                }
                form {
                    background-color: #ffffff;
                    padding: 20px;
                    border-radius: 8px;
                    box-shadow: 0 0 10px rgba(0,0,0,0.1);
                }
                input[type="text"] {
                    width: 300px;
                    padding: 10px;
                    margin-bottom: 10px;
                    border-radius: 4px;
                    border: 1px solid #ccc;
                }
                input[type="submit"] {
                    padding: 10px 20px;
                    border: none;
                    border-radius: 4px;
                    background-color: #008CBA;
                    color: #fff;
                    cursor: pointer;
                }
            </style>
        </head>
        <body>
            <form action="/fetch" method="get">
                <input type="text" name="url" placeholder="Enter URL to fetch" required>
                <input type="submit" value="Fetch">
            </form>
            <br>
            <br>
            <h3>__TEXT__</h3>
        </body>
    </html>
    '''.replace('__TEXT__', text)

@auth.verify_password
def verify_password(username, password):
    global USERNAME, PASSWORD
    return username == USERNAME and password == PASSWORD

@app.route('/')
@auth.login_required
def index():
    return ssrf_html()

@app.route('/fetch', methods=['GET', 'POST'])
@auth.login_required
def fetch_url():
    url = ""
    if request.method == 'GET':
        url = request.args.get('url')
    elif request.method == 'POST':
        url = request.form.get('url')

    if not url:
        return ssrf_html('Please provide a URL')

    try:
        response = requests.get(url)
        return f'<pre>{response.text}</pre>'
    except:
        return ssrf_html('Unable to fetch URL')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=PORT)