SSRF labs
Server-Side Request Forgery (SSRF)
What is SSRF?
SSRF lets you force the server to make HTTP requests to arbitrary destinations, including internal services, cloud provider metadata and private networks. It's especially critical in cloud environments because of access to IAM credentials.
Why practice SSRF?
With the mass migration to the cloud (AWS, GCP, Azure), SSRF has become a high-impact vulnerability. An SSRF that reaches cloud metadata can hand over the entire infrastructure. Bounties for critical SSRF frequently exceed $5,000.
What will you learn with the SSRF labs?
You'll learn to identify features that accept URLs (webhook validators, image fetchers, PDF generators), bypass blacklists with IPv6/decimal/octal, abuse metadata endpoints (169.254.169.254 + IMDSv1, GCP, Azure), and detect blind SSRF via Burp Collaborator.
Types of SSRF we cover
- Basic SSRF
The server returns the response of the URL you pass. You read /etc/passwd via file:// or internals via http://localhost.
- Blind SSRF
The server makes the request but doesn't return the response. You detect it via DNS callback (Burp Collaborator).
- Cloud metadata
AWS IMDSv1: GET 169.254.169.254/latest/meta-data/iam/security-credentials/ → IAM creds.
- Gopher / SMTP smuggling
Exotic protocols to talk to internal non-HTTP services (Redis, Memcached, SMTP).
- DNS rebinding
Pre-fetch validation bypass: your DNS answers a public IP the first time, an internal IP the second.
How do you find and exploit SSRF?
A practical playbook — from recon to proof of concept.
- 1
Find the URL-fetching feature
Webhooks, URL validators, link previewers, import-by-URL, PDF/image generators and 'avatar from URL'. Any parameter carrying a URL is a candidate.
POST /api/webhook {"url":"https://x.oast.fun"} → does the callback arrive? - 2
Confirm internal reach
Point at localhost and metadata to see whether the server reaches internal resources not exposed externally.
url=http://127.0.0.1:80 · url=http://169.254.169.254/ - 3
Steal cloud credentials
If IMDSv1 is present, read the IAM role and its temporary credentials: direct access to the infrastructure.
http://169.254.169.254/latest/meta-data/iam/security-credentials/ - 4
Bypass the blacklist
If they filter 127.0.0.1/localhost, use alternate IP representations, IPv6, redirects or a domain that resolves to an internal address.
http://2130706433/ · http://[::1]/ · http://127.0.0.1.nip.io/ - 5
Exploit blind SSRF
When it doesn't return the response, use Burp Collaborator to confirm the callback and map internal ports via timing/state differences.
url=http://x.burpcollaborator.net → DNS+HTTP interaction received - 6
Pivot with gopher
To talk to non-HTTP services (Redis, Memcached, SMTP), forge the protocol with gopher:// and achieve write/RCE.
gopher://127.0.0.1:6379/_SET%20x%20payload
Learn the theory
Academy: Server-Side Request Forgery (SSRF)
Loading labs...
View in full catalog →Frequently asked questions
What is SSRF?
Server-Side Request Forgery is a vulnerability that lets you force the server to make requests (HTTP or other protocols) to attacker-chosen destinations, including internal services, cloud metadata and private networks unreachable from outside.
How is an SSRF exploited?
You feed a controlled URL into a feature the server fetches. Pointing at http://169.254.169.254 steals IAM credentials on AWS; at http://localhost reaches internal panels; and with gopher:// you interact with Redis or SMTP to escalate to RCE.
How do you find SSRF in bug bounty?
Locate any parameter that accepts a URL (webhooks, image fetching, previews, PDF generators) and try a Burp Collaborator domain. If you get the callback, you have SSRF; then try to reach metadata and internals.
How do you prevent SSRF?
Use a strict domain/IP allowlist, resolve and validate the final IP after following redirects, block internal and link-local ranges (169.254.0.0/16, 127.0.0.0/8), require IMDSv2 on AWS, and disable protocols like file:// and gopher://.
Difference between SSRF and Open Redirect?
In SSRF the server makes the request (it can reach internals and metadata). In Open Redirect it's the victim's browser that's redirected. That's why an Open Redirect is often used to bypass an SSRF's allowlist and chain the two.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice SSRF in real labs
Every SSRF lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime