# Lorsrf | Tool to Bruteforce SSRF Parameter

**URL:** <https://onehack.st/t/lorsrf-tool-to-bruteforce-ssrf-parameter/205871>\
**Category:** Tools & Scripts\
**Tags:** hacking\
**Created:** [November 3, 2021, 7:55am UTC](https://onehack.st/t/lorsrf-tool-to-bruteforce-ssrf-parameter/205871 "2021-11-03T07:55:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [November 3, 2021, 7:55am UTC](https://onehack.st/t/lorsrf-tool-to-bruteforce-ssrf-parameter/205871/1 "2021-11-03T07:55:43Z")

</div>

[https://github.com/knassar702/lorsrf/raw/master/src/lorsrf.gif](https://github.com/knassar702/lorsrf/raw/master/src/lorsrf.gif)

Lorsrf has been added to [scant3r](https://github.com/knassar702/scant3r) with useful additions (multi http method , multi content-type (json , query , xml , speed , large worlist and more))

- [https://github.com/knassar702/scant3r/wiki/lorsrf](https://github.com/knassar702/scant3r/wiki/lorsrf)

# lorsrf

Bruteforcing on Hidden parameters to find SSRF vulnerability using `GET` and `POST` Methods

## install

- download it

➜ git clone [https://github.com/knassar702/lorsrf](https://github.com/knassar702/lorsrf) ➜ cd lorsrf ➜ sudo pip3 install requests flask

- install [ngrok tool](https://www.youtube.com/watch?v=4sF1ATYwr3U)

## Steps :

### Ngrok

- run your ngrok `./ngrok http 9090`
- run `server.py` script and add ngrok port `python3 server.py 9090`
- run `lorsrf.py` and add ngrok host using `-s` option

### [requestbin.com](http://requestbin.com)

- login to [https://requestbin.com](https://requestbin.com/)
- copy your host and add it by using `-s` option (without `server.py` file)

## How can i use it .?

`cat YOUR_LIST.txt | python3 lorsrf.py -t URL_TARGET -s YOUR_HOST -w wordlist.txt`

## Examples :

$ cat paramters.txt | python3 lorsrf.py -t [http://target.com](http://target.com) -s [http://53252.ngrok.io](http://53252.ngrok.io)

- add threads

$ cat paramters.txt | python3 lorsrf.py -t [http://target.com](http://target.com) -s [http://53252.ngrok.io](http://53252.ngrok.io) --threads=50

- add timeout

$ cat paramters.txt | python3 lorsrf.py -t [http://target.com](http://target.com) -s [http://53252.ngrok.io](http://53252.ngrok.io) --timeout=4

- add cookies

$ cat paramters.txt | python3 lorsrf.py -t [http://target.com](http://target.com) -s [http://53252.ngrok.io](http://53252.ngrok.io) -c ‘user=5&PHPSESSION=5232’

- add headers from text file

$ cat headers.txt Cookie: test=1 Auth: Basic TG9yU3JmCg== $ cat parameters.txt | python3 lorsrf.py -f headers.txt -s ‘[http://myhost.com](http://myhost.com)’ -t ‘[http://ssrf.hack.com](http://ssrf.hack.com)’ --------------------- GET /?parameter={YOUR\_HOST} HTTP/1.1 Host: [targer.com](http://targer.com) Cookie: test=1 Auth: Basic TG9yU3JmCg==

- Follow redirects

$ cat paramters.txt | python3 lorsrf.py -t [http://target.com](http://target.com) -s [http://53252.ngrok.io](http://53252.ngrok.io) -r

## Testing

python3 lorsrf.py -t ‘[http://testphp.vulnweb.com/showimage.php](http://testphp.vulnweb.com/showimage.php)’ -s ‘https://YOUR\_HOST.com’ -w parameters.txt

## GIF

[![](https://github.com/knassar702/lorsrf/raw/master/src/lorsrf.gif)](https://github.com/knassar702/lorsrf/blob/master/src/lorsrf.gif)

## GitHub:

[https://github.com/knassar702/lorsrf](https://github.com/knassar702/lorsrf)