# Server Side Request Forgery (SSRF)

**Blogs / Articles:**

* SSRF Bible - <https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit>
* <http://niiconsulting.com/checkmate/2015/04/server-side-request-forgery-ssrf/>
* <https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF>
* <https://cfdb.io/Web/Server-Side%20Request%20Forgery>
* <http://www.smeegesec.com/2017/10/detecting-ssrf-using-aws-services.html>
* <https://medium.com/bugbountywriteup/bug-bounty-fastmail-feeda67905f5>
* <http://www.sxcurity.pro/2017/12/17/hackertarget/>
* <https://mike-n1.github.io/SSRF_P4toP2>
* <https://medium.com/@auxy233/the-design-and-implementation-of-ssrf-attack-framework-550e9fda16ea>
* <https://blog.christophetd.fr/abusing-aws-metadata-service-using-ssrf-vulnerabilities/>
* <https://www.shawarkhan.com/2018/05/getting-read-access-on-edmodo.html>
* <https://medium.com/@valeriyshevchenko/subdomain-takeover-with-shopify-heroku-and-something-more-6e9504da34a1>
* <https://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf>
* <https://medium.com/@arbazhussain/svg-xlink-ssrf-fingerprinting-libraries-version-450ebecc2f3c>
* <https://desc0n0cid0.blogspot.com/2019/01/chaining-2-low-impact-bugs-into-gitlab.html>
* Blind SSRF - <https://lab.wallarm.com/blind-ssrf-exploitation/>
* Bypasses - <https://subhajitsaha.com/bypassing-ssrfs-like-a-king/>
* <https://t.co/oMmwp61vt6?amp=1>
* [**https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202**](https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202)
* [**https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77**](https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77)
* [**https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b**](https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b)
* [**https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/**](https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/)
* [**https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba**](https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba)

**Cheatsheets / Guides:**

* <https://github.com/cujanovic/SSRF-Testing>
* <https://gist.github.com/jhaddix/78cece26c91c6263653f31ba453e273b>
* <https://github.com/allanlw/svg-cheatsheet>
*

**Tips / Twitter Threads:**

* <http://blog.safebuff.com/2016/07/03/SSRF-Tips/>
* <https://twitter.com/omespino/status/998603788020781056>
* <https://twitter.com/trouble1_raunak/status/1216200502309871616>
* SSRF Breakpoints - <https://twitter.com/s0md3v/status/1210130223334715393>
* SSRF - bypass <https://twitter.com/SMHTahsin33/status/1293601681834307584>
* <https://twitter.com/HusseiN98D/status/1258217821693190154?s=20>

**Tools / Payloads:**

* <https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SSRF%20injection>
* [<br>](https://twitter.com/subhajitsaha0x/status/1257728798914523136)

![https://twitter.com/m4ll0k/status/1328375464281452547](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEKThEuWhi5FGHtpiR%2F-MWEKfnWh_h1Vu5Yhzuu%2Fimage.png?alt=media\&token=0ab697c9-617d-4566-abf9-359c2b03e3b1)

[SSRF Bypass list for localhost (127.0.0.1):](https://twitter.com/LooseSecurity/status/1331270289733324805)

[http://127.1/ http://0000::1:80/ http://\[::\]:80/ http://2130706433/ http://whitelisted@127.0.0.1 http://0x7f000001/ http://017700000001 http://0177.00.00.01](https://twitter.com/LooseSecurity/status/1331270289733324805)

[Also using a redirect to localhost will often work.](https://twitter.com/LooseSecurity/status/1331270289733324805)

![](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEMGB46Flk9NqS-1jg%2F-MWEMWLJdlCBA_gM4sfa%2Fimage.png?alt=media\&token=37d5737c-dfd6-4b73-bb55-bb40d5b5603a)

![](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEQ_IwLCeelt8OKriS%2F-MWEUUW5hLKRY3EmP52W%2Fimage.png?alt=media\&token=cc32e210-6677-4fe5-a0cd-b7487bcf3ad9)

{% embed url="<https://twitter.com/samwcyo/status/1246997498981494784?s=20>" %}

{% embed url="<https://twitter.com/ADITYASHENDE17/status/1296820434613149697?s=20>" %}

{% embed url="<https://twitter.com/osiryszzz/status/1473310062990872582>" %}

Blind - <https://lab.wallarm.com/blind-ssrf-exploitation/>

{% embed url="<https://labs.f-secure.com/blog/from-http-referer-to-aws-security-credentials/>" %}

{% embed url="<https://x.com/s0md3v/status/1210130223334715393>" %}

* <https://resources.securitycompass.com/blog/ssrf-as-a-service-mitigating-a-design-level-software-security-vulnerability-2>
* <https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/>
*

```
<figure><img src="https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmdDaax1PAvLD05wJYt%2Fuploads%2Fo4424rw6jUzlDFxWgN1g%2Fimage.png?alt=media&#x26;token=2b4ea51b-5525-4a45-8940-076ba9071982" alt=""><figcaption></figcaption></figure>
```