Skip to main content
SSRF (Server-Side Request Forgery) occurs when a web application fetches a remote resource based on user-supplied input and an attacker can manipulate that input to make the server request arbitrary URLs. Depending on configuration, this can range from minor information disclosure to full internal network access and RCE.

​
Confirming SSRF

Start with a URL pointing at a host you control and listen for the callback. If the request arrives, SSRF is confirmed.
Supply http://$LHOST:8000/test in the vulnerable parameter and watch for the incoming request.

​
Basic Payloads

Hit localhost and the link-local range first: internal services and cloud metadata endpoints are the most common targets.

​
AWS Metadata

The IMDSv1 endpoint hands out IAM credentials with no auth: if the app is on EC2 and SSRF is confirmed, hit this immediately.

​
Bypass Filters

Blocklists keyed on “127.0.0.1” or “localhost” miss decimal, hex, and wildcard DNS representations.

​
Port Scanning

Use SSRF to sweep internal ports. A closed port typically returns a connection refused error; an open port returns a response or times out differently. Compare error messages to distinguish open from closed.

​
Internal Endpoint Enumeration

Once you identify an internal hostname, enumerate its paths through the SSRF parameter.
Filter on the error string that appears for non-existent pages to keep only valid hits.

​
File Read via file://

Switch to the file:// scheme to read local files from the server’s filesystem.

​
Protocol Smuggling

Switch protocols to reach non-HTTP internal services: gopher is especially powerful for attacking Redis, memcached, and SMTP.

​
Gopher: Sending POST Requests

The gopher:// scheme sends raw bytes to a TCP socket, letting you craft arbitrary HTTP requests including POST bodies. This is useful when the SSRF target requires a POST request that the http:// scheme cannot send. Build the raw request, URL-encode spaces as %20 and newlines as %0D%0A, prefix with gopher://host:port/_, then double-encode the entire URL because the parameter itself is URL-encoded.

​
Gopherus

Gopherus automates gopher URL construction for common internal services.
After providing the prompted inputs, Gopherus outputs a ready-to-use gopher URL. Double-encode it before inserting into a URL-encoded POST parameter.

​
Blind SSRF

When the response is not reflected back, you can only infer whether the request was made by checking your listener for callbacks.
If no callback arrives when pointing at your server but the app behaves differently when pointing at an internal host, the SSRF is still useful for port scanning via timing or error message differences. Full exploitation (file read, gopher POST) is unavailable without response reflection.