Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?

closed as unclear what you're asking by forest, Josef, ThoriumBR, Steffen Ullrich, Tom K. Sep 17 '18 at 9:49

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Do you want to test on the python/VPS server, or do you want to test on another site using the python/VPS server? And what is the difference between a python server and a VPS server? – schroeder Sep 4 '18 at 22:42

I think you need to understand how those vulnerabilities works.

Example: In RCE the attacker needs a vulnerability to run shell commands on victim server. So if you make a simple webpage in python with a small input and button where user can execute shell commands. Then you can test RCE.

Also you can create your own penetration testing lab, check these: Metasploitable DVWA bWAPP


No, you cannot do that using SimpleHTTPServer. It will only read and send back any existing file on the server, and a 404 error on anything else.

There's no processing at all. No script, no server-side include, no database access. Just read that file and send back.

And I don't know what a VPS has to do with that. A VPS is just a computer, like any other, but "in the cloud." It sits on another layer - the hardware. As such, using a VPS, a Playstation 2, a virtual machine, a docker container or a physical mainframe running Linux bare-metal does not change anything.

Not the answer you're looking for? Browse other questions tagged or ask your own question.