Skip to content

Conversation

@HamzaSahin61
Copy link
Contributor

Template / PR Information

Adds a blind SSRF detector using OAST across common URL/redirect parameters:
url, next, redirect, continue, download, image, feed, callback, return.

Path
http/vulnerabilities/ssrf/blind-ssrf-oast-multiparam.yaml

Why
Server-side URL fetch/redirect endpoints often accept external URLs.
This template confirms SSRF via OAST interaction, reducing false positives.

Template Validation

I've validated this template locally:

  • YES

Sample run (anonymized)

# OAST client in background
interactsh-client -o hits.txt &

# sample run (example target; real targets omitted)
nuclei -u https://example.com \
  -t http/vulnerabilities/ssrf/blind-ssrf-oast-multiparam.yaml \
  -rl 10 -c 10 -retries 1 -stats

@DhiyaneshGeek
Copy link
Member

Hi @HamzaSahin61

Thanks for sharing the template, we already have template for this in DAST format dast/vulnerabilities/ssrf/response-ssrf.yaml

Due to the following reason, we are closing this PR

@DhiyaneshGeek DhiyaneshGeek requested review from DhiyaneshGeek and removed request for ritikchaddha October 1, 2025 15:03
@DhiyaneshGeek DhiyaneshGeek added the Done Ready to merge label Oct 1, 2025
@HamzaSahin61 HamzaSahin61 deleted the feat/blind-ssrf-oast branch October 4, 2025 15:57
@HamzaSahin61 HamzaSahin61 restored the feat/blind-ssrf-oast branch October 4, 2025 15:57
@HamzaSahin61 HamzaSahin61 deleted the feat/blind-ssrf-oast branch October 5, 2025 20:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Done Ready to merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants