CloudSSRFer aims to develop a tool that detects SSRF (Server-Side Request Forgery) vulnerabilities in URLs and determines if the target host is hosted on AWS cloud services. The tool will further attempt to extract sensitive data from metadata internal endpoints and display the results in a formatted output.
The tool will analyze URLs provided by the user and check for SSRF vulnerability. SSRF vulnerabilities occur when an attacker can manipulate a server's request to access internal resources or services.
The tool will identify if the target host is hosted on AWS cloud services. This detection can help in understanding the potential attack surface and the associated risks.
If the target host is hosted on AWS cloud services and an SSRF vulnerability is present, the tool will attempt to extract sensitive data from metadata internal endpoints. AWS metadata contains valuable information about the instance, such as access keys, security group configurations, and more.
The tool will provide a formatted output that clearly presents the results. This output can include detailed information about the detected vulnerabilities, AWS services identification, and any extracted sensitive data.
This tool is designed to work exclusively with IMDSv1 (Instance Metadata Service version 1), ensuring compatibility and accurate extraction of sensitive data from metadata internal endpoints.
Make sure you have Python 3 installed on your system. You can download Python from the official website: Python.org
- Clone the project repository:
git clone https://github.com/TheWation/CloudSSRFer- Navigate to the project directory:
cd CloudSSRFer- Install the required dependencies using pip:
pip install -r requirements.txt- Run the CloudSSRFer script:
python CloudSSRFer.py https://vulnerable.com/?url=For educational purposes only. Do not use for illegal activities. Use at your own risk. By using this tool, you agree to comply with all applicable laws and regulations. Unauthorized use is strictly prohibited. Always obtain permission before using this tool. No warranties.
CloudSSRFer is made with ♥ by Wation and it's released under the MIT license.