# SSRF Vulnerability Lab The project is a laboratory containing PHP code that is vulnerable to server-side request counterfeiting (SSRF) attacks and aims to demonstrate and educate users about different scenarios and exploitations of SSRF vulnerabilities. ##Function Introduction 1. ** File content extraction **: Application code can extract and display the content of a specified file. If this feature is not properly path prefixed for user input, it may be misused to access inappropriate files or remote URLs. 2. ** Remote host connection interface **: The application provides an interface that allows users to specify IP and port to connect to remote services (such as MySQL, LDAP, etc.). If user input is not processed securely, attackers can use this feature to conduct internal network scans. 3. ** File download feature **: Attackers can use this feature to perform IP scanning within the network where the application server is located, and may even download files from the SMB path. 4. ** Bypass IP blacklist via DNS spoofing **: Applications allow users to obtain data from remote URLs, but check and block access to blacklist IPs (e.g. localhost, internal IP). Attackers can use DNS spoofing techniques to circumvent these restrictions. 5. ** Bypass IP blacklist through DNS rebinding **: The application not only blacklists the internal and private IP ranges, but also resolves the domain name provided by the user and checks whether the resolved IP is in the blacklist. Using DNS rebinding technology, attackers can circumvent this restriction. 6. ** SSRF in the HTML-to-PDF generator **: Applications use the HTML-to-PDF generator to process HTML files input by users, and attackers can use untrusted user input to conduct SSRF attacks.
