ssrf-server-side-request-forgery

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSRF techniques. Covers URL filter bypass, cloud metadata endpoints, protocol exploitation, blind SSRF detection, and chaining to RCE. Base models know basic 169.254.169.254 — this file covers what they miss. For real-world CVE chains, DNS Rebinding deep dives, K8s SSRF, and SSRF → Redis → RCE full exploitation, load the companion SCENARIOS.md.

0. QUICK START

Extended Scenarios

Also load SCENARIOS.md when you need:

WebLogic SSRF (CVE-2014-4210) — uddiexplorer/SearchPublicRegistries.jsp + operator parameter + %0D%0A CRLF to inject Redis commands
SSRF → internal Redis → write crontab reverse shell complete payload chain
DNS Rebinding deep dive — TTL=0 trick, initial-legit→second-internal resolution, rbndr.us service
Kubernetes SSRF (CVE-2020-8555) and bypass (CVE-2020-8562) via DNS rebinding
SSRF through PDF/screenshot generators — <iframe> and <img> in HTML-to-PDF
Gopher protocol full TCP injection — Redis, MySQL, FastCGI payloads via Gopherus
URL parser confusion for filter bypass — #@, \@, %00@, IPv6-mapped IPv4

Advanced Reference

Also load URL_PARSER_TRICKS.md when you need:

URL parser differential table: Python urllib vs requests vs Java URL vs PHP parse_url vs Node url.parse vs Go net/url
Full cloud metadata endpoint catalog (AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud, Oracle Cloud, Kubernetes, Hetzner, OpenStack)
gopher:// payload recipes for Redis, MySQL, SMTP, FastCGI, Memcached (with encoding rules)
DNS Rebinding detailed attack flow with TTL manipulation and TOCTOU analysis
PDF/wkhtmltopdf/WeasyPrint/Chrome headless/PhantomJS SSRF patterns and exfiltration techniques

If you just found a parameter that fetches a URL, perform first-pass confirmation here directly.

First-pass payloads

http://127.0.0.1/
http://localhost/
http://169.254.169.254/latest/meta-data/
http://[::1]/
http://127.1/

Host validation bypass families

Validation Type	Try
blocks `localhost` string	`127.0.0.1`, `127.1`, `[::1]`
blocks direct IP only	internal DNS name, decimal/octal/hex IP forms
allowlist by prefix	username part, subdomain confusion, redirect chain
follows redirects	benign external URL redirecting to internal target
parses once, fetches twice	mixed encoding or DNS rebinding style targets

Protocol routing

Goal	Protocol / Target
cloud credentials	metadata HTTP endpoints
internal HTTP admin	`http://127.0.0.1:port/`
Redis / raw TCP style abuse	`gopher://`
local file read candidate	`file://`
dictionary / banner tests	`dict://`

1. FINDING SSRF SURFACE

Look for any parameter containing DNS names, IP addresses, or URLs:

loc=           url=        path=         endpoint=
imageUrl=      dest=       redirect=     uri=
callback=      load=       file=         resource=
link=          src=        data=         ref=

Less obvious SSRF vectors:

PDF/screenshot generation (URL to capture)
Webhook configuration fields
Import/export via URL (CSV import, RSS/Atom feeds)
OAuth redirect URI (sometimes triggers server-side fetch)
X-Forwarded-Host / X-Real-IP headers in proxy chains
XML DOCTYPE with external entity (file://, http://)
GraphQL @link directive (federation)
Content-Type: text/html pages parsed for <link> preload headers

2. BASIC CONFIRMATION METHODOLOGY

3. CLOUD METADATA ENDPOINTS — MUST-TRY

AWS EC2 IMDSv1 (no auth required — critical)

AWS IMDSv2 (token required — but check if SSRF can GET the token)

If SSRF supports custom headers → full IMDSv2 bypass.

Google Cloud

Azure

Alibaba Cloud

Kubernetes Service Account

4. IP ADDRESS FILTER BYPASS TECHNIQUES

When 169.254.169.254, 127.0.0.1, localhost are blocked:

Localhost Variants

169.254.169.254 Variants

Private Network Ranges

Bypass Filter via DNS Input

If filter checks DNS-resolved IP (not hostname):

Use DNS rebinding: initial lookup returns valid IP → passes filter → second request returns internal IP.

5. URL SCHEME ATTACKS

When http:// is allowed or weakly filtered:

Redis Gopher SSRF (full RCE potential)

When response doesn't reflect fetched content:

Burp Collaborator / interact.sh: check for DNS + HTTP request from server
Pingback/webhook abuse: configure application's own webhook to your URL
Timing analysis: Internal open port vs closed port response time difference
Error analysis: Different error messages for "host not found" vs "connection refused" vs "timeout" reveal internal network topology

7. INTERNAL SERVICE EXPLOITATION

Docker API (2375 unauthenticated)

Elasticsearch (9200 no-auth default)

Redis (6379 — no-auth common)

Internal Admin Panels

8. SSRF + FILTER BYPASS DECISION TREE

9. THE SSRF-FILTER MINDSET

From zseano's methodology: if developers filter only 169.254.169.254 directly but not http://169.254.169.254/latest/meta-data (full path), or forget about:

IPv6 equivalents
DNS names that resolve to internal IPs
Redirect chains (server follows 302 to internal IP)

Classic gap: App filters 127.0.0.1 but not 127.1 or [::1] or localhost.

Application-layer SSRF via XML (when app parses XML):

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSRF techniques. Covers URL filter bypass, cloud metadata endpoints, protocol exploitation, blind SSRF detection, and chaining to RCE. Base models know basic 169.254.169.254 — this file covers what they miss. For real-world CVE chains, DNS Rebinding deep dives, K8s SSRF, and SSRF → Redis → RCE full exploitation, load the companion SCENARIOS.md.

0. QUICK START

Extended Scenarios

Also load SCENARIOS.md when you need:

WebLogic SSRF (CVE-2014-4210) — uddiexplorer/SearchPublicRegistries.jsp + operator parameter + %0D%0A CRLF to inject Redis commands
SSRF → internal Redis → write crontab reverse shell complete payload chain
DNS Rebinding deep dive — TTL=0 trick, initial-legit→second-internal resolution, rbndr.us service
Kubernetes SSRF (CVE-2020-8555) and bypass (CVE-2020-8562) via DNS rebinding
SSRF through PDF/screenshot generators — <iframe> and <img> in HTML-to-PDF
Gopher protocol full TCP injection — Redis, MySQL, FastCGI payloads via Gopherus
URL parser confusion for filter bypass — #@, \@, %00@, IPv6-mapped IPv4

Advanced Reference

Also load URL_PARSER_TRICKS.md when you need:

URL parser differential table: Python urllib vs requests vs Java URL vs PHP parse_url vs Node url.parse vs Go net/url
Full cloud metadata endpoint catalog (AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud, Oracle Cloud, Kubernetes, Hetzner, OpenStack)
gopher:// payload recipes for Redis, MySQL, SMTP, FastCGI, Memcached (with encoding rules)
DNS Rebinding detailed attack flow with TTL manipulation and TOCTOU analysis
PDF/wkhtmltopdf/WeasyPrint/Chrome headless/PhantomJS SSRF patterns and exfiltration techniques

If you just found a parameter that fetches a URL, perform first-pass confirmation here directly.

First-pass payloads

http://127.0.0.1/
http://localhost/
http://169.254.169.254/latest/meta-data/
http://[::1]/
http://127.1/

Host validation bypass families

Validation Type	Try
blocks `localhost` string	`127.0.0.1`, `127.1`, `[::1]`
blocks direct IP only	internal DNS name, decimal/octal/hex IP forms
allowlist by prefix	username part, subdomain confusion, redirect chain
follows redirects	benign external URL redirecting to internal target
parses once, fetches twice	mixed encoding or DNS rebinding style targets

Protocol routing

Goal	Protocol / Target
cloud credentials	metadata HTTP endpoints
internal HTTP admin	`http://127.0.0.1:port/`
Redis / raw TCP style abuse	`gopher://`
local file read candidate	`file://`
dictionary / banner tests	`dict://`

1. FINDING SSRF SURFACE

Look for any parameter containing DNS names, IP addresses, or URLs:

loc=           url=        path=         endpoint=
imageUrl=      dest=       redirect=     uri=
callback=      load=       file=         resource=
link=          src=        data=         ref=

Less obvious SSRF vectors:

PDF/screenshot generation (URL to capture)
Webhook configuration fields
Import/export via URL (CSV import, RSS/Atom feeds)
OAuth redirect URI (sometimes triggers server-side fetch)
X-Forwarded-Host / X-Real-IP headers in proxy chains
XML DOCTYPE with external entity (file://, http://)
GraphQL @link directive (federation)
Content-Type: text/html pages parsed for <link> preload headers

2. BASIC CONFIRMATION METHODOLOGY

3. CLOUD METADATA ENDPOINTS — MUST-TRY

AWS EC2 IMDSv1 (no auth required — critical)

AWS IMDSv2 (token required — but check if SSRF can GET the token)

If SSRF supports custom headers → full IMDSv2 bypass.

Google Cloud

Azure

Alibaba Cloud

Kubernetes Service Account

4. IP ADDRESS FILTER BYPASS TECHNIQUES

When 169.254.169.254, 127.0.0.1, localhost are blocked:

Localhost Variants

169.254.169.254 Variants

Private Network Ranges

Bypass Filter via DNS Input

If filter checks DNS-resolved IP (not hostname):

Use DNS rebinding: initial lookup returns valid IP → passes filter → second request returns internal IP.

5. URL SCHEME ATTACKS

When http:// is allowed or weakly filtered:

Redis Gopher SSRF (full RCE potential)

When response doesn't reflect fetched content:

Burp Collaborator / interact.sh: check for DNS + HTTP request from server
Pingback/webhook abuse: configure application's own webhook to your URL
Timing analysis: Internal open port vs closed port response time difference
Error analysis: Different error messages for "host not found" vs "connection refused" vs "timeout" reveal internal network topology

7. INTERNAL SERVICE EXPLOITATION

Docker API (2375 unauthenticated)

Elasticsearch (9200 no-auth default)

Redis (6379 — no-auth common)

Internal Admin Panels

8. SSRF + FILTER BYPASS DECISION TREE

9. THE SSRF-FILTER MINDSET

From zseano's methodology: if developers filter only 169.254.169.254 directly but not http://169.254.169.254/latest/meta-data (full path), or forget about:

IPv6 equivalents
DNS names that resolve to internal IPs
Redirect chains (server follows 302 to internal IP)

Classic gap: App filters 127.0.0.1 but not 127.1 or [::1] or localhost.

Application-layer SSRF via XML (when app parses XML):

ssrf-server-side-request-forgery

Documentation

Documentation

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

0. QUICK START

Extended Scenarios

Advanced Reference

First-pass payloads

Host validation bypass families

Protocol routing

1. FINDING SSRF SURFACE

2. BASIC CONFIRMATION METHODOLOGY

3. CLOUD METADATA ENDPOINTS — MUST-TRY

AWS EC2 IMDSv1 (no auth required — critical)

AWS IMDSv2 (token required — but check if SSRF can GET the token)

Google Cloud

Azure

Alibaba Cloud

Kubernetes Service Account

4. IP ADDRESS FILTER BYPASS TECHNIQUES

Localhost Variants

169.254.169.254 Variants

Private Network Ranges

Bypass Filter via DNS Input

5. URL SCHEME ATTACKS

Redis Gopher SSRF (full RCE potential)

6. BLIND SSRF DETECTION

7. INTERNAL SERVICE EXPLOITATION

Docker API (2375 unauthenticated)

Elasticsearch (9200 no-auth default)

Redis (6379 — no-auth common)

Internal Admin Panels

8. SSRF + FILTER BYPASS DECISION TREE

9. THE SSRF-FILTER MINDSET

Documentation

ssrf-server-side-request-forgery

Documentation

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

0. QUICK START

Extended Scenarios

Advanced Reference

First-pass payloads

Host validation bypass families

Protocol routing

1. FINDING SSRF SURFACE

2. BASIC CONFIRMATION METHODOLOGY

3. CLOUD METADATA ENDPOINTS — MUST-TRY

AWS EC2 IMDSv1 (no auth required — critical)

AWS IMDSv2 (token required — but check if SSRF can GET the token)

Google Cloud

Azure

Alibaba Cloud

Kubernetes Service Account

4. IP ADDRESS FILTER BYPASS TECHNIQUES

Localhost Variants

169.254.169.254 Variants

Private Network Ranges

Bypass Filter via DNS Input

5. URL SCHEME ATTACKS

Redis Gopher SSRF (full RCE potential)

6. BLIND SSRF DETECTION

7. INTERNAL SERVICE EXPLOITATION

Docker API (2375 unauthenticated)

Elasticsearch (9200 no-auth default)

Redis (6379 — no-auth common)

Internal Admin Panels

8. SSRF + FILTER BYPASS DECISION TREE

9. THE SSRF-FILTER MINDSET