---
description: References for SSRF
---

# Server Side Request Forgery (SSRF)

**Blogs / Articles:**

* SSRF Bible - [https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit](https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit)
* [http://niiconsulting.com/checkmate/2015/04/server-side-request-forgery-ssrf/](http://niiconsulting.com/checkmate/2015/04/server-side-request-forgery-ssrf/)
* [https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF](https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF)
* [https://cfdb.io/Web/Server-Side%20Request%20Forgery](https://cfdb.io/Web/Server-Side%20Request%20Forgery)
* [http://www.smeegesec.com/2017/10/detecting-ssrf-using-aws-services.html](http://www.smeegesec.com/2017/10/detecting-ssrf-using-aws-services.html)
* [https://medium.com/bugbountywriteup/bug-bounty-fastmail-feeda67905f5](https://medium.com/bugbountywriteup/bug-bounty-fastmail-feeda67905f5)
* [http://www.sxcurity.pro/2017/12/17/hackertarget/](http://www.sxcurity.pro/2017/12/17/hackertarget/)
* [https://mike-n1.github.io/SSRF\_P4toP2](https://mike-n1.github.io/SSRF_P4toP2)
* [https://medium.com/@auxy233/the-design-and-implementation-of-ssrf-attack-framework-550e9fda16ea](https://medium.com/@auxy233/the-design-and-implementation-of-ssrf-attack-framework-550e9fda16ea)
* [https://blog.christophetd.fr/abusing-aws-metadata-service-using-ssrf-vulnerabilities/](https://blog.christophetd.fr/abusing-aws-metadata-service-using-ssrf-vulnerabilities/)
* [https://www.shawarkhan.com/2018/05/getting-read-access-on-edmodo.html](https://www.shawarkhan.com/2018/05/getting-read-access-on-edmodo.html)
* [https://medium.com/@valeriyshevchenko/subdomain-takeover-with-shopify-heroku-and-something-more-6e9504da34a1](https://medium.com/@valeriyshevchenko/subdomain-takeover-with-shopify-heroku-and-something-more-6e9504da34a1)
* [https://www.agarri.fr/docs/AppSecEU15-Server\_side\_browsing\_considered\_harmful.pdf](https://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf)
* [https://medium.com/@arbazhussain/svg-xlink-ssrf-fingerprinting-libraries-version-450ebecc2f3c](https://medium.com/@arbazhussain/svg-xlink-ssrf-fingerprinting-libraries-version-450ebecc2f3c)
* [https://desc0n0cid0.blogspot.com/2019/01/chaining-2-low-impact-bugs-into-gitlab.html](https://desc0n0cid0.blogspot.com/2019/01/chaining-2-low-impact-bugs-into-gitlab.html)
* Blind SSRF - [https://lab.wallarm.com/blind-ssrf-exploitation/](https://lab.wallarm.com/blind-ssrf-exploitation/)
* Bypasses - [https://subhajitsaha.com/bypassing-ssrfs-like-a-king/](https://subhajitsaha.com/bypassing-ssrfs-like-a-king/)
* [https://t.co/oMmwp61vt6?amp=1](https://t.co/oMmwp61vt6?amp=1)
* [**https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202**](https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202)
* [**https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77**](https://bughunter25.medium.com/a-tale-of-html-to-pdf-converter-ssrf-and-various-bypasses-4a3e11030c77)
* [**https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b**](https://chawdamrunal.medium.com/how-i-exploit-out-of-band-resource-load-http-using-burp-suite-extension-plugin-taborator-2c5065d6a50b)
* [**https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/**](https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/)
* [**https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba**](https://notifybugme.medium.com/chaining-an-blind-ssrf-bug-to-get-an-rce-92c09de3c0ba)





**Cheatsheets / Guides:**

* [https://github.com/cujanovic/SSRF-Testing](https://github.com/cujanovic/SSRF-Testing)
* [https://gist.github.com/jhaddix/78cece26c91c6263653f31ba453e273b](https://gist.github.com/jhaddix/78cece26c91c6263653f31ba453e273b)
* [https://github.com/allanlw/svg-cheatsheet](https://github.com/allanlw/svg-cheatsheet)
*



**Tips / Twitter Threads:**

* [http://blog.safebuff.com/2016/07/03/SSRF-Tips/](http://blog.safebuff.com/2016/07/03/SSRF-Tips/)
* [https://twitter.com/omespino/status/998603788020781056](https://twitter.com/omespino/status/998603788020781056)
* [https://twitter.com/trouble1\_raunak/status/1216200502309871616](https://twitter.com/trouble1_raunak/status/1216200502309871616)
* SSRF Breakpoints - [https://twitter.com/s0md3v/status/1210130223334715393](https://twitter.com/s0md3v/status/1210130223334715393)
* SSRF - bypass [https://twitter.com/SMHTahsin33/status/1293601681834307584](https://twitter.com/SMHTahsin33/status/1293601681834307584)
* [https://twitter.com/HusseiN98D/status/1258217821693190154?s=20](https://twitter.com/HusseiN98D/status/1258217821693190154?s=20)



**Tools / Payloads:**

* [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SSRF%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SSRF%20injection)
* [\
  ](https://twitter.com/subhajitsaha0x/status/1257728798914523136)

![https://twitter.com/m4ll0k/status/1328375464281452547](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEKThEuWhi5FGHtpiR%2F-MWEKfnWh_h1Vu5Yhzuu%2Fimage.png?alt=media\&token=0ab697c9-617d-4566-abf9-359c2b03e3b1)



[SSRF Bypass list for localhost (127.0.0.1):](https://twitter.com/LooseSecurity/status/1331270289733324805)

[http://127.1/ http://0000::1:80/ http://\[::\]:80/ http://2130706433/ http://whitelisted@127.0.0.1 http://0x7f000001/ http://017700000001 http://0177.00.00.01](https://twitter.com/LooseSecurity/status/1331270289733324805)

[Also using a redirect to localhost will often work.](https://twitter.com/LooseSecurity/status/1331270289733324805)

![](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEMGB46Flk9NqS-1jg%2F-MWEMWLJdlCBA_gM4sfa%2Fimage.png?alt=media\&token=37d5737c-dfd6-4b73-bb55-bb40d5b5603a)

![](https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LmdDaax1PAvLD05wJYt%2F-MWEQ_IwLCeelt8OKriS%2F-MWEUUW5hLKRY3EmP52W%2Fimage.png?alt=media\&token=cc32e210-6677-4fe5-a0cd-b7487bcf3ad9)

{% embed url="https://twitter.com/samwcyo/status/1246997498981494784?s=20" %}

{% embed url="https://twitter.com/ADITYASHENDE17/status/1296820434613149697?s=20" %}

{% embed url="https://twitter.com/osiryszzz/status/1473310062990872582" %}

Blind - [https://lab.wallarm.com/blind-ssrf-exploitation/](https://lab.wallarm.com/blind-ssrf-exploitation/)

{% embed url="https://labs.f-secure.com/blog/from-http-referer-to-aws-security-credentials/" %}

{% embed url="https://x.com/s0md3v/status/1210130223334715393" %}

* [https://resources.securitycompass.com/blog/ssrf-as-a-service-mitigating-a-design-level-software-security-vulnerability-2](https://resources.securitycompass.com/blog/ssrf-as-a-service-mitigating-a-design-level-software-security-vulnerability-2)
* [https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/](https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/)
*

    <figure><img src="https://3284959579-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LmdDaax1PAvLD05wJYt%2Fuploads%2Fo4424rw6jUzlDFxWgN1g%2Fimage.png?alt=media&#x26;token=2b4ea51b-5525-4a45-8940-076ba9071982" alt=""><figcaption></figcaption></figure>
