SSRF via PDF? Now made easy.
(thread)
1. Go to @jonasl github and clone this repo. Can't paste the link, for some reason @twitter thinks it's malicious...
2. Copy Burp Collaborator URL to the clipboard.
3. Use as
4. Test file upload features with the generated PDFs.
5. PRO tip: On some endpoints, you need to provide base64 data.
You can use the search engine to find a PDF => Base64 converter. Use the base64 value in the input, usually via a POST request parameter.
6. Comment below if you know of other similar tools! Such as for images for example.
7. If you enjoyed this thread, there's much more to come! So, stay tuned.
Like, retweet, and follow me @cristivlad25 for more.
#pentesting #appsec #infosec #cybersecurity #hacking #bugbountytips #bugbounty #ethicalhacking
