diff --git a/aikido_zen/helpers/try_parse_url.py b/aikido_zen/helpers/try_parse_url.py index c4a15be47..f1bbff27e 100644 --- a/aikido_zen/helpers/try_parse_url.py +++ b/aikido_zen/helpers/try_parse_url.py @@ -1,7 +1,7 @@ """Helper function file""" from urllib.parse import urlparse - +from urllib3.util import parse_url def try_parse_url(url): """Tries to parse the url using urlparse""" @@ -12,3 +12,13 @@ def try_parse_url(url): return None except Exception: return None + +def try_lenient_parse_url(url): + """Tries to parse the url using parse_url, which is more lenient than urlparse""" + try: + parsed_url = parse_url(url) + if parsed_url.scheme and parsed_url.host: + return parsed_url + return None + except Exception: + return None diff --git a/aikido_zen/vulnerabilities/ssrf/find_hostname_in_userinput.py b/aikido_zen/vulnerabilities/ssrf/find_hostname_in_userinput.py index 07934b04c..9dbc02009 100644 --- a/aikido_zen/vulnerabilities/ssrf/find_hostname_in_userinput.py +++ b/aikido_zen/vulnerabilities/ssrf/find_hostname_in_userinput.py @@ -6,7 +6,7 @@ from urllib.parse import unquote from aikido_zen.helpers.get_port_from_url import get_port_from_url -from aikido_zen.helpers.try_parse_url import try_parse_url +from aikido_zen.helpers.try_parse_url import try_lenient_parse_url def find_hostname_in_userinput(user_input, hostname_options: List[str], port=None): @@ -28,9 +28,9 @@ def find_hostname_in_userinput(user_input, hostname_options: List[str], port=Non ] for variant in variants: - user_input_url = try_parse_url(variant) + user_input_url = try_lenient_parse_url(variant) if user_input_url and user_input_url.hostname in hostname_options: - user_port = get_port_from_url(user_input_url.geturl()) + user_port = get_port_from_url(user_input_url.url) # We were unable to retrieve the port from the URL, likely because it contains an invalid port. # Let's assume we have found the hostname in the user input, even though it doesn't match on port. diff --git a/aikido_zen/vulnerabilities/ssrf/handle_http_response.py b/aikido_zen/vulnerabilities/ssrf/handle_http_response.py index 9806490c8..8d3b7c946 100644 --- a/aikido_zen/vulnerabilities/ssrf/handle_http_response.py +++ b/aikido_zen/vulnerabilities/ssrf/handle_http_response.py @@ -2,7 +2,7 @@ from aikido_zen.context import get_current_context from aikido_zen.helpers.is_redirect_status_code import is_redirect_status_code -from aikido_zen.helpers.try_parse_url import try_parse_url +from aikido_zen.helpers.try_parse_url import try_lenient_parse_url from .find_hostname_in_context import find_hostname_in_context from .get_redirect_origin import get_redirect_origin @@ -29,7 +29,7 @@ def handle_http_response(http_response, source): if not isinstance(location, str): return - parsed_location = try_parse_url(location) + parsed_location = try_lenient_parse_url(location) if not parsed_location: return