standard ssrf test

Author: notshivansh

Server-Side-Request-Forgery/StandardSSRF.yml

@@ -0,0 +1,65 @@
+---
+id: STANDARD_SSRF
+info:
+  name: SSRF test by injecting internal URLs into query and body parameters
+  description: >
+    This test checks for Server-Side Request Forgery (SSRF) vulnerabilities by injecting internal URLs (such as https://test-services.akto.io) into query and body parameters of API requests. It validates whether the server makes unauthorized requests to these URLs, indicating a potential SSRF risk.
+  details: >
+    The test identifies parameters in the request payload or query string that accept URLs. It then replaces these parameters with internal URLs containing a random UUID and sends the request to the server. The test follows redirects and monitors if the server attempts to access the injected URL, confirming SSRF behavior. Successful exploitation is validated by checking for a 2xx response and verifying that the injected URL was hit by the server.
+  impact: >
+    If SSRF is possible, attackers can force the server to make requests to internal or external resources, potentially accessing sensitive data, cloud metadata, or internal services. This can lead to data breaches, privilege escalation, and compromise of internal infrastructure. Preventing SSRF is critical to maintaining the security and integrity of web applications and backend systems.
+  category:
+    name: SSRF
+    shortName: Server Side Request Forgery
+    displayName: Server Side Request Forgery (SSRF)
+  subCategory: STANDARD_SSRF
+  severity: LOW
+  tags:
+  - Business logic
+  - OWASP top 10
+  - HackerOne top 10
+  references:
+  - https://github.com/OWASP/API-Security/blob/master/2023/en/src/0xa6-server-side-request-forgery.md
+  - https://www.akto.io/blog/how-to-prevent-server-side-request-forgery-ssrf-as-a-developer
+  cwe:
+  - CWE-918
+  cve:
+  - CVE-2022-4725
+api_selection_filters:
+  response_code:
+    and:
+      gte: 200
+      lt: 205
+  or:
+  - request_payload:
+      for_one:
+        key:
+          regex: http
+          extract: param_key
+  - query_param:
+      for_one:
+        key:
+          regex: http
+          extract: param_key
+
+wordLists:
+  redirect_urls:
+  - https://test-services.akto.io/health
+
+execute:
+  type: single
+  requests:
+  - req:
+    - send_ssrf_req:
+        url: "https://test-services.akto.io/store_uuid/${random_uuid}"
+        redirect_url: "${redirect_urls}"
+    - follow_redirect: true
+    - modify_query_param:
+        param_key: "https://test-services.akto.io/${random_uuid}"
+    - modify_body_param:
+        param_key: "https://test-services.akto.io/${random_uuid}"
+validate:
+  response_code:
+    gte: 200
+    lt: 300
+  ssrf_url_hit: "${random_uuid}"