Skip to main content
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate a web application into sending requests from the server. It typically occurs when an application fetches a remote resource (an image, a PDF, a “fetch URL” field, e.g.) based on user controlled input. Successful exploitation can let an attacker reach internal only services, bypass network restrictions and read local files.

Identifying SSRF

Start by looking for any parameter, header, or file upload that causes the server to make an outbound request on your behalf, URL fetchers, PDF/image renderers, webhook/callback URLs, “import from URL” features, link previews, e.g. To confirm it, point the parameter at yourself first:
If a connection comes in, the server is making the request. Once confirmed, probe internal addressing to map what the server can reach:
Enumerate internal ports/services behind the SSRF with ffuf, using a response based filter to spot the difference between open and closed ports:

URL Schemes

If the application accepts a user supplied URL scheme rather than assuming http(s)://, the attack surface grows:
SchemeEffect
http:// / https://Standard HTTP/S request, used to reach internal endpoints, bypass WAFs, or hit cloud metadata services
file://Reads a file from the local filesystem (Local File Inclusion via SSRF)
gopher://Sends arbitrary raw bytes to a TCP socket, used to forge POST requests or speak to non-HTTP services (SMTP, Redis, MySQL, etc.)
dict://Queries a dictionary-protocol server, useful for banner-grabbing and probing Redis/Memcached
sftp://Secure file transfer, can be abused to probe for an open SFTP service
tftp://Transfers data over UDP - sometimes slips past filters that only block TCP schemes
ldap://Can be used to interact with LDAP services

Local File Inclusion (file://)

Since the scheme is attacker-controlled, reading local files is often as simple as entering:
This only returns the raw file content (no code execution), but it’s useful for reading configuration files, source code, and SSH keys from the local disk.

Bypassing Filters & Whitelists

Applications often try to block SSRF by blacklisting localhost/127.0.0.1 or whitelisting specific domains. Common bypasses:
  • Alternate IP representations of localhost
  • Open redirects: if the whitelist check only validates the first request, chain through a redirect you control (http://allowed-domain.com/redirect?url=http://127.0.0.1/) to land on the real target.
You can find a more detailed list of bypasses in the PayloadsAllTheThings’ SSRF bypass cheatsheet.

Sending POST Requests via Gopher

Most basic SSRFs only let you issue GET requests. The gopher:// scheme lets you send arbitrary bytes to a TCP socket, which means you can craft a HTTP request to reach endpoints that only accept POST. Say the target endpoint expects:
All special characters need to be URL-encoded to build a valid gopher URL, spaces become %20 and newlines become %0D%0A. Prefix the encoded data with the scheme, target host, port, and an underscore:
Gopher isn’t limited to HTTP, it can talk to any TCP service, including SMTP, Redis, and MySQL. Hand-building these payloads is not that easy, so use Gopherus to generate them automatically for a target service:

Quick Reference Tools

Gopherus

Generates gopher payloads for MySQL, Redis, FastCGI, SMTP, and more.

SSRFmap

Automates SSRF exploitation (port scan, file read, cloud metadata, etc.) from a captured request.

PayloadsAllTheThings: SSRF

Large collection of localhost/whitelist bypass payloads.

HackTricks: SSRF

Broader bypass catalogue and protocol-smuggling tricks.

HackTricks: Cloud SSRF

Per-provider metadata endpoints and header requirements (AWS, GCP, Azure, etc.).

OWASP SSRF Prevention Cheat Sheet

Defensive reference, useful for understanding what mitigations you’re likely to run into.