modified validator for checking ssrf hit

akto-api-security · Mar 16, 2024 · 3cc855a · 3cc855a
1 parent c32f29f
commit 3cc855a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/apps/testing/src/main/java/com/akto/test_editor/Utils.java b/apps/testing/src/main/java/com/akto/test_editor/Utils.java
@@ -657,7 +657,12 @@ public static ExecutorSingleOperationResp sendRequestToSsrfServer(String request
         }
     }
 
-    public static Boolean sendRequestToSsrfServer(String requestUrl){
+    public static Boolean sendRequestToSsrfServer(String url){
+        String requestUrl = "";
+        if(!(url.startsWith("http"))){
+            requestUrl = "http://ssrf.akto.io/validate/" + url;
+        }
+
         Request request = new Request.Builder()
             .url(requestUrl)
             .get()

diff --git a/...esting/src/main/java/com/akto/test_editor/filter/data_operands_impl/SsrfUrlHitFilter.java b/...esting/src/main/java/com/akto/test_editor/filter/data_operands_impl/SsrfUrlHitFilter.java
@@ -4,6 +4,7 @@
 import java.util.List;
 
 import com.akto.dto.test_editor.DataOperandFilterRequest;
+import com.akto.test_editor.Utils;
 
 public class SsrfUrlHitFilter extends DataOperandsImpl {
 
@@ -21,8 +22,10 @@ public Boolean isValid(DataOperandFilterRequest dataOperandFilterRequest) {
         }
 
         for (String queryString: querySet) {
-            System.out.println(queryString);
-            // trigger function here
+            if(Utils.sendRequestToSsrfServer(queryString)){
+                result = true;
+                break;
+            }
         }
 
         return result;