> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-server-side-request-forgery-ssrf/ssrf-api-pentesting-web.md).

# SSRF API

## [SSRF](/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-server-side-request-forgery-ssrf.md):

“浏览”按钮允许我们上传一个文件，预期它是一张表示书封面的图片；而文本字段“与你的书籍关联的封面 URL”允许我们输入一个 URL，以便服务获取并下载该图片。

<figure><img src="/files/827ea9b7e67d4a8ed8608facf6a56296c8056ccf" alt=""><figcaption></figcaption></figure>

#### **开篇** [**Burp Suite** ](https://hacking-notes-jordan.gitbook.io/notes/autres/burpsuite)**:**

当图片上传到服务器后，会提供一个指向其存储位置的链接。

<figure><img src="/files/5f407d068e303471b3fa2884ac215b5d7945527b" alt=""><figcaption></figcaption></figure>

然后，我们对 65535 个端口进行暴力扫描，并注意到只有 5000 端口返回了不同的响应。

<figure><img src="/files/02ce942cb36c29af3a94bf58b3ae81e7e962a35f" alt=""><figcaption></figcaption></figure>

通过检查 5000 端口的内部内容，我们发现它允许上传文件。

<figure><img src="/files/dcf8de53c6c2d730ba20c4359a83ae6dacaecc8e" alt=""><figcaption></figcaption></figure>

这个 JSON 文件列出了内部 API 及其对应的路由。其中，路由 `message/authors` 似乎特别关键。

<figure><img src="/files/40f3ccfc62997092c9a33c1629645bdf6c0663b2" alt=""><figcaption></figcaption></figure>

因此，我们使用 Burp Suite 通过 5000 端口访问下面地址中的文件：

```url
http://127.0.0.1:5000/api/latest/metadata/messages/authors

```

<figure><img src="/files/015b01bf8d621bf872c399f655a6dc18ca4f1002" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/e8262cebc67438ee2526e873598c55bf728a0593" alt=""><figcaption></figcaption></figure>

在这个文件中，我们还发现了一个明文存储的用户名和密码 `dev:dev080217_devAPI!@`

<figure><img src="/files/48861c71a328409113fef247ee660d11771cb96b" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-server-side-request-forgery-ssrf/ssrf-api-pentesting-web.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.