SSRF-King – SSRF Plugin For Burp Automates SSRF Detection In All Of The Request
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 1 ssrf king 11](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_11.png)
SSRF plugin for burp that Automates SSRF Detection in all of the Request
Upcoming Features Checklist
-
It will soon have a user Interface to specifiy your own call back payload
- It will soon be able to test Json & XML
- Test for SMTP SSRF
How to Install/Build
git clone https://github.com/ethicalhackingplayground/ssrf-king
gradle build
- Now the file “ssrf-king.jar” could be found under build/libs which can then be imported Burpsuite.
- Alternatively, goto releases to download the compiled file.
Features
-
Test all of the request for any external interactions.
-
Checks to see if any interactions are not the users IP if it is, it’s an open redirect.
-
Alerts the user for any external interactions with information such as:
- Endpoint Vulnerable
- Host
- Location Found
It also performs the following tests based on this research:
Reference:
https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface
GET http://burpcollab/some/endpoint HTTP/1.1
Host: example.com
...
and
GET @burpcollab/some/endpoint HTTP/1.1
Host: example.com
...
and
GET /some/endpoint HTTP/1.1
Host: example.com:80@burpcollab
...
and
GET /some/endpoint HTTP/1.1
Host: burpcollab
...
and
GET /some/endpoint HTTP/1.1
Host: example.com
X-Forwarded-Host: burpcollab
...
Scanning Options
-
Supports Both Passive & Active Scanning.
Example
- Load the website you want to test.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 2 ssrf king 4 ss 1](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_4_ss-1.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 2 ssrf king 4 ss 1](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_4_ss-1.png)
- Add it as an inscope host in burp.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 3 ssrf king 5 ss 2](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_5_ss-2.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 3 ssrf king 5 ss 2](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_5_ss-2.png)
- Load the plugin.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 4 ssrf king 6 ss 3](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_6_ss-3.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 4 ssrf king 6 ss 3](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_6_ss-3.png)
- Keep note of the Burp Collab Payload.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 5 ssrf king 7 ss 4](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_7_ss-4.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 5 ssrf king 7 ss 4](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_7_ss-4.png)
- Passively crawl the page, ssrf-king test everything in the request on the fly.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 6 ssrf king 8 ssf 5](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_8_ssf-5.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 6 ssrf king 8 ssf 5](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_8_ssf-5.png)
- When it finds a vulnerabilitiy it logs the information and adds an alert.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 7 ssrf king 9 ssrf 6](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_9_ssrf-6.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 7 ssrf king 9 ssrf 6](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_9_ssrf-6.png)
From here onwards you would fuzz the parameter to test for SSRF.
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 8 ssrf king 10 ssrf 7](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_10_ssrf-7.png)
![SSRF-King - SSRF Plugin For Burp Automates SSRF Detection In All Of The Request 8 ssrf king 10 ssrf 7](https://www.redpacketsecurity.com/wp-content/uploads/2021/01/ssrf-king_10_ssrf-7.png)
Video Demonstration
Download Ssrf-King
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.