Server-Side Request Forgery (SSRF)
SSRF is a security vulnerability that occurs when an attacker manipulates a server to make HTTP requests to an unintended location. This happens when the server processes user-provided URLs or IP addresses without proper validation.
Common exploitation paths:
Accessing Cloud metadata
Leaking files on the server
Network discovery, port scanning with the SSRF
Sending packets to specific services on the network, usually to achieve a Remote Command Execution on another server
Identify Potential SSRF Entry Points
🔍 Look for parameters, headers, and input fields that accept URLs:
URL parameters (
?url=,?link=,?redirect=,?callback=,?next=, etc.)JSON / XML body (
"image": "http://example.com/img.jpg")Headers (
Referer,X-Forwarded-For,Host, etc.)Hidden form fields (
<input type="hidden" name="webhook_url" value="http://example.com/webhook">)Redirect behavior on function, parameter, field.
OAuth / API integrations that retrieve external resources
Common SSRF Payloads
Enumerate internal network via SSRF
Bypass Localhost with on SSRF
Blind SSRF with Shellshock exploitation
Burp suite Detection via collaborator-everywhere pro
Manual Testing every request you visit:
Exploit:
Last updated