Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add protection against redirects for SSRF #118

Merged
merged 26 commits into from
Aug 27, 2024
Merged

Add protection against redirects for SSRF #118

merged 26 commits into from
Aug 27, 2024

Conversation

bitterpanda63
Copy link
Contributor

No description provided.

Wout Feys added 26 commits August 26, 2024 10:39
Add helper function is_redirect_status_code
460d408
Add new attribute to context : outgoing_req_redirects
e5a6caf
If context is not set, skip the cache
0038e3c
Add unit tests for cache function in extract_strings_from_user_input
5ac0644
Merge branch 'bugfix-make-sure-context-is-set-cache' into AIK-3296
6d74c2b
Add unit tests for find_hostname_in_context
1a08f1c
Add function get_redirect_origin
59fdc0d
Fix tests by monkeypatching get_current_context
042a988
Add another test for get_port_from_url (from node PR)
fe522e2
Make sure to deepcopy the url in get_redirect_origin
ea7d28e
Add is_redirect_to_private_ip and some tests
d00db03
Linting
c3738ce
Split up inspect_getaddrinfo_result function
af4af7b
Merge branch 'main' into AIK-3296
c61924a
Merge branch 'main' into AIK-3296
531d8dd
Create new function scan_for_ssrf_in_request
128eec5
Use new function and pass along a URL objcet
b9d83aa
Use the correct name, outgoing_req_redirects
1c88b0c
context.outgoing_req_redirect -> context.outgoing_req_redirects
2484d13
Create a new file with functions handle_http_response (WIP)
7e06307
Change get_redirect_origin to return parsed urls &
7f3870f 
Use parsed urls + normalize urls
Update http_client wrapping : wrap getresponse and
d614a4f 
try-catch everything a bit better
update handle_http_response to make it work with
210d235 
an actual response
args[0] is not a dict in run_vulnerability_scan
8b75994
Add logging for redirects and simplify code
d70039c
Fix broken SSRF tests
e5deb3b
@bitterpanda63 bitterpanda63 marked this pull request as ready for review August 27, 2024 13:24
@kapyteinaikido kapyteinaikido self-requested a review August 27, 2024 13:49
@willem-delbare willem-delbare merged commit d9e0ccb into main Aug 27, 2024
8 of 9 checks passed
@willem-delbare willem-delbare deleted the AIK-3296 branch August 27, 2024 14:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kapyteinaikido kapyteinaikido Awaiting requested review from kapyteinaikido

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@bitterpanda63 @willem-delbare