ssrf-sheriff
ssrf-sheriff copied to clipboard
Added: dynamic images (JPG/PNG) generator with SSRF token
Hey @teknogeek 👋
Motivation
While playing with your utility I noticed that when I send a request to routes:
-
GET
/abc.jpg -
GET
/abc.gif
The server is returning an image with size (1x1)
. And I think it will cool to add as a minimum full-size image in response.
Because in some type of Content-Based SSRF (like in Screenshot / PDF generators ) it is difficult for the attacker to check whether he was able to get an image from the internal infrastructure. If the image only takes 1x1 pixel. In this case, it is easy not to notice that the vulnerability has been successfully exploited.
Changes
In this pull-request I have added:
- Added: generator which is dynamically generated images (JPG/PNG - 1024/768 size) with SSRF token while utility startup.
- Updated: README.md.