Server Side Request Forgery (SSRF)
This page contains my tips and tricks for SSRF exploitation.
Detecting Endpoints
To facilitate the automated identification of endpoints that may be vulnerable, I typically employ regular expressions (regex) in my approach.
(\?|\&)([^=]+)\=https?:\/\/([^&]+)
The regex above detects endpoint with URL parameters.
Capturing Requests
To effectively capture the requests initiated by Server-Side Request Forgery (SSRF), the following methods are my preferred choices:
BurpSuite Collabrator
Juicy Endpoints for Cloud
Common Bypass Techniques
Given that the majority of web applications employ various whitelist and/or blacklist protection mechanisms, it is often necessary to navigate through multiple security layers to achieve successful exploitation. The following methods are my preffered choices:
URL Rewrite
URL format bypasses
Secondary exploitation with a simple PHP web server.
Automating SSRF Discovery
Given that Burp Suite enables the utilization of regular expressions in its match and replace rules, devising an automated process for the detection of Server-Side Request Forgery (SSRF) becomes a relatively straightforward task.
Last updated
Was this helpful?