Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
closed as unclear what you're asking by forest, Josef, ThoriumBR, Steffen Ullrich, Tom K. Sep 17 '18 at 9:49
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I think you need to understand how those vulnerabilities works.
Example: In RCE the attacker needs a vulnerability to run shell commands on victim server. So if you make a simple webpage in python with a small input and button where user can execute shell commands. Then you can test RCE.
No, you cannot do that using SimpleHTTPServer. It will only read and send back any existing file on the server, and a 404 error on anything else.
There's no processing at all. No script, no server-side include, no database access. Just read that file and send back.
And I don't know what a VPS has to do with that. A VPS is just a computer, like any other, but "in the cloud." It sits on another layer - the hardware. As such, using a VPS, a Playstation 2, a virtual machine, a docker container or a physical mainframe running Linux bare-metal does not change anything.