# Web Ssrf

> Discover and escalate Server-Side Request Forgery. Load when the app fetches a URL you influence: webhooks, "import from URL", link/image preview, PDF/HTML render, avatar-by-URL, URL health-checks, XML/SVG parsers. Signals: params like url=, uri=, dest=, callback=, image=, feed=, or a request that reaches out on your behalf.

- Skill: `noorqureshi/web-ssrf` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/web-ssrf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/web-ssrf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/web-ssrf

---


# Server-Side Request Forgery (SSRF)

## When it applies
The server makes an outbound request to a destination you control or influence. Even a
"blind" fetch (no response shown) is useful if you can see the callback and reach internal
services.

## Why it works
The request originates from inside the trust boundary, so it bypasses network ACLs and hits
things you can't reach directly: cloud metadata, internal admin panels, databases, other
microservices — often unauthenticated because they "only accept internal traffic".

## Method
1. **Confirm** with an out-of-band beacon: point the param at your `interactsh`/Collaborator
   host and watch for the DNS/HTTP hit. DNS-only hit = blind SSRF (still valuable).
2. **Map internal reach**: try `http://127.0.0.1:<port>/`, `http://localhost`, and the
   cloud metadata IP `169.254.169.254`. Fuzz ports to find live internal services.
3. **Escalate by target**:
   - **Cloud metadata** → steal IAM creds (see `cloud-imds-ssrf`).
   - **Internal line-protocol service** (Redis/6379, memcached) → RCE via `gopher://`
     (see `web-ssrf-gopher-redis-rce`).
   - **Internal HTTP admin** → hit unauthenticated actions.
4. **Bypass filters** blocking `localhost`/private IPs: decimal/octal/hex IPs
   (`http://2130706433/`), `[::]`, `127.0.0.1.nip.io`, DNS-rebinding, `@`-tricks
   (`http://expected.com@attacker.com`), and redirect chains (allowed host 302s to internal).

## Gotchas
- Allowlist on scheme/host is often only on the *first* request — a 30x redirect slips past.
- SSRF via SVG/`<image>`/PDF renderers and via `Location`/webhook retries is easy to miss.
- No response body ≠ no vuln: timing and OOB confirm blind SSRF.

## Verify success
OOB callback from the target's egress IP, or a response revealing an internal-only resource
(metadata JSON, an internal 200/redirect you shouldn't reach).

## References
PortSwigger SSRF labs; Orange Tsai "A New Era of SSRF".