Use DNS Rebinding to Bypass SSRF in Java

/*
        * check SSRF (判斷邏輯為判斷URL的IP是否是內網IP)
        * 如果是內網IP，返回false，表示checkSSRF不通過。否則返回true。即合法返回true
        * URL只支持HTTP協議
        * 設置了訪問超時時間為3s
     */
    public static Boolean checkSSRF(String url) {

        HttpURLConnection connection;
        String finalUrl = url;
        try {
            do {
                // 判斷當前請求的URL是否是內網ip
                Boolean bRet = isInnerIpFromUrl(finalUrl);
                if (bRet) {
                    return false;
                }

                connection = (HttpURLConnection) new URL(finalUrl).openConnection();
                connection.setInstanceFollowRedirects(false);
                connection.setUseCaches(false); // 設置為false，手動處理跳轉，可以拿到每個跳轉的URL
                connection.setConnectTimeout(3*1000); // 設置連接超時時間為3s
                //connection.setRequestMethod("GET");
                connection.connect(); // send dns request
                int responseCode = connection.getResponseCode(); // 發起網絡請求 no dns request
                if (responseCode >= 300 && responseCode < 400) {
                    String redirectedUrl = connection.getHeaderField("Location");
                    if (null == redirectedUrl)
                        break;
                    finalUrl = redirectedUrl;
                    // System.out.println("redirected url: " + finalUrl);
                } else
                    break;
            } while (connection.getResponseCode() != HttpURLConnection.HTTP_OK);
            connection.disconnect();
        } catch (Exception e) {
            return true;
        }
        return true;
    }

    /*
        內網IP：
        10.0.0.1 - 10.255.255.254       (10.0.0.0/8)
        192.168.0.1 - 192.168.255.254   (192.168.0.0/16)
        127.0.0.1 - 127.255.255.254     (127.0.0.0/8)
        172.16.0.1 - 172.31.255.254     (172.16.0.0/12)
    */
    public static boolean isInnerIp(String strIP) throws IOException {
        try{
            String[] ipArr = strIP.split("//.");
            if (ipArr.length != 4){
                return false;
            }

            int ip_split1 = Integer.parseInt(ipArr[1]);

            return (ipArr[0].equals("10") ||
                    ipArr[0].equals("127") ||
                    (ipArr[0].equals("172") && ip_split1 >= 16 && ip_split1 <=31) ||
                    (ipArr[0].equals("192") && ipArr[1].equals("168")));
        }catch (Exception e) {
            return false;
        }

    }
    /*
        * 域名轉換為IP
        * 會將各種進制的ip轉為正常ip
        * 167772161轉換為10.0.0.1
        * 127.0.0.1.xip.io轉換為127.0.0.1
    */
    public static String DomainToIP(String domain) throws IOException{
        try {
            InetAddress IpAddress = InetAddress.getByName(domain); //  send dns request
            return IpAddress.getHostAddress();
        }
        catch (Exception e) {
            return "";
        }
    }

    /*
        從URL中獲取域名
        限制為http/https協議
    */
    public static String getUrlDomain(String url) throws IOException{
        try {
            URL u = new URL(url);
            if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) {
                throw new IOException("Protocol error: " + u.getProtocol());
            }
            return u.getHost();
        } catch (Exception e) {
            return "";
        }

    }