ssrf
Server-Side Request Forgery: forcing the server to make internal requests or hit cloud metadata.
Quick answer
What is ssrf?
Server-Side Request Forgery: forcing the server to make internal requests or hit cloud metadata.
Articles
5
Beginner
0
Intermediate
1
Advanced
4
Intermediate level
1Advanced level
4Headless browsers — SSRF and RCE in endpoints that render URLs
Endpoints that accept URLs for screenshots/PDF (Puppeteer, Playwright, wkhtmltopdf) are an SSRF goldmine: cloud metadata, file://, gopher://, JS injection with XSS-to-RCE in the chromium sandbox.
Next.js attack surface 2026 — middleware bypass, internal SSRF, RSC abuse
Next.js 13-16 specific vulnerabilities: middleware bypass with manipulated headers, SSRF in API routes, RSC (React Server Components) data leak, image optimization SSRF.
SSRF — complete bypasses: localhost, IPv6, decimal, DNS and cloud metadata
11 techniques to bypass SSRF validation: enclosed alphanumeric, decimal IP, dot bypass, DNS rebinding, parameter pollution. Cloud metadata AWS/GCP/Azure.
SSRF — localhost bypasses, DNS rebinding, cloud metadata, gopher://
A complete catalog of SSRF bypasses in 2026: IP encodings (decimal, hex, octal, dword), DNS rebinding, IPv6 abuse, cloud metadata (AWS IMDSv2, GCP, Azure), gopher:// for chaining to Redis/Memcached RCE.
Practice ssrf with real labs
Apply the techniques in safe environments based on real bug bounty reports.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime