{"id":13844383,"url":"https://github.com/MustafaSky/Guide-to-SSRF","last_synced_at":"2025-07-11T22:31:52.772Z","repository":{"id":170632920,"uuid":"351715153","full_name":"MustafaSky/Guide-to-SSRF","owner":"MustafaSky","description":"Guide to SSRF","archived":false,"fork":false,"pushed_at":"2023-10-10T08:17:21.000Z","size":45,"stargazers_count":64,"open_issues_count":0,"forks_count":21,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-08-05T17:41:43.424Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MustafaSky.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-03-26T08:39:34.000Z","updated_at":"2024-08-04T08:30:03.000Z","dependencies_parsed_at":null,"dependency_job_id":"e0caa89b-bbfd-451f-8a77-4df1b96233c1","html_url":"https://github.com/MustafaSky/Guide-to-SSRF","commit_stats":null,"previous_names":["mustafasky/guide-to-ssrf"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaSky%2FGuide-to-SSRF","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaSky%2FGuide-to-SSRF/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaSky%2FGuide-to-SSRF/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaSky%2FGuide-to-SSRF/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MustafaSky","download_url":"https://codeload.github.com/MustafaSky/Guide-to-SSRF/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225763369,"owners_count":17520444,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:41.428Z","updated_at":"2024-11-21T16:31:20.720Z","avatar_url":"https://github.com/MustafaSky.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# Guide to SSRF 🌐\n\n## The Basics\n\n- [Server Side Request Forgery (OWASP)](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)\n- [SSRF: Web App Security Basics](https://infosecwriteups.com/ssrf-web-app-security-basics-b88da872c9c8)\n- [SSRF-Server Side Request Forgery](https://medium.com/@briskinfosec/ssrf-server-side-request-forgery-ae44ec737cb8)\n- [What is Server-Side Request Forgery (SSRF)?](https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/)\n- [SSRF: What is Server Side Request Forgery?](https://hdivsecurity.com/bornsecure/ssrf-what-is-server-side-request-forgery/)\n- [Understanding the Web Vulnerability Server-Side Request Forgery (1/2)](https://www.vaadata.com/blog/understanding-web-vulnerability-server-side-request-forgery-1/)\n- [Exploiting the SSRF vulnerability (2/2)](https://www.vaadata.com/blog/exploiting-the-ssrf-vulnerability/)\n- [3 Types of SSRF Attacks and How to Prevent Them](https://www.neuralegion.com/blog/ssrf-server-side-request-forgery/)\n- [SSRF](https://0x221b.github.io/SSRF)\n\n## Server Side Request Forgery Prevention 🚫\n\n- [Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html#case-1-application-can-send-request-only-to-identified-and-trusted-applications%2034)\n\n## A powerful tool: SSRFmap, SSRF bug with automation 🛠️\n\n- [SSRFmap](https://github.com/swisskyrepo/SSRFmap)\n- [tomnomnom/gf](https://github.com/tomnomnom/gf)\n- [tomnomnom/qsreplace](https://github.com/tomnomnom/qsreplace)\n- [ffuf](https://github.com/ffuf/ffuf)\n- [gau](https://github.com/lc/gau)\n- [waybackurls](https://github.com/tomnomnom/waybackurls)\n- [quickpress](https://github.com/pownx/quickpress)\n- [automate SSRF wordpress and XMLRPC finder](https://github.com/pownx/quickpress)\n- [Finding SSRF by Full Automation](https://notifybugme.medium.com/finding-ssrf-by-full-automation-7d2680091d68)\n- [Bug Bounty tip Automating SSRF](https://dant0x65.medium.com/bug-bounty-tip-automating-ssrf-ea344ec59962)\n- [ssrf-sheriffhggi](https://github.com/teknogeek/ssrf-sheriff)\n\n## SSRF Techniques 🛡️\n\n- [SSRF Techniques](https://www.xmind.net/m/eJm7bd/)\n\n## Writeups ✍️\n\n* [An unknown Linux secret that turned SSRF to OS Command injection](https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202)\n\n* [Story Behind Sweet SSRF](https://rohit-soni.medium.com/story-behind-sweet-ssrf-40c705f13053)\n\n* [GITLAB — Just another SSRF issue.](https://ltsirkov.medium.com/gitlab-just-another-ssrf-issue-483bc040392b)\n\n* [Blind SSRF Chains](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/)\n\n* [A New Era of SSRF Trending Programming Languages! - BlackHat 2017](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf)\n\n* [Blind SSRF Chains](https://github.com/assetnote/blind-ssrf-chains)\n\n* [$10000 Facebook SSRF (Bug Bounty)](https://amineaboud.medium.com/10000-facebook-ssrf-bug-bounty-402bd21e58e5)\n\n* [31k$ SSRF in Google Cloud Monitoring led to metadata exposure](https://nechudav.blogspot.com/2020/11/31k-ssrf-in-google-cloud-monitoring.html?m=1)\n\n* [SSRF (Server Side Request Forgery) worth $4,913 | My Highest Bounty Ever !](https://medium.com/techfenix/ssrf-server-side-request-forgery-worth-4913-my-highest-bounty-ever-7d733bb368cb)\n\n* [Blind SSRF - The Hide \u0026 Seek Game](https://shahjerry33.medium.com/blind-ssrf-the-hide-seek-game-da9d0ecef2fb)\n\n* [How i found 3 SSRF in one day on different bug bounty targets](https://medium.com/@Mr.Daman.Singh/how-i-found-3-ssrf-in-one-day-on-different-bug-bounty-targets-62e91b4268f8)\n\n* [Exploiting: SSRF For Admin Access](https://infosecwriteups.com/exploiting-ssrf-for-admin-access-31c30457cc44)\n\n* [Unauthenticated Full-Read SSRF in Grafana CVE-2020-13379](https://rhynorater.github.io/CVE-2020-13379-Write-Up)\n\n* [My First Bug: Blind SSRF Through Profile Picture Upload](https://infosecwriteups.com/my-first-bug-blind-ssrf-through-profile-picture-upload-72f00fd27bc6)\n\n* [A tale of my first ever full SSRF bug](https://infosecwriteups.com/a-tale-of-my-first-ever-full-ssrf-bug-4fe71a76e9c4)\n\n* [How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!](https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html)\n\n* [Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text](https://infosecwriteups.com/story-of-a-2-5k-bounty-ssrf-on-zimbra-led-to-dump-all-credentials-in-clear-text-6fe826005ccc)\n\n* [From . in regex to SSRF — part 1](https://xvnpw.medium.com/from-in-regex-to-ssrf-part-1-31d5706854ef)\n\n* [From . in regex to SSRF — part 2](https://xvnpw.medium.com/from-in-regex-to-ssrf-part-2-7e4ff261de85)\n\n* [ (SSRF) ON LYFT](https://nahamsec.com/posts/my-expense-report-resulted-in-a-server-side-request-forgery-ssrf-on-lyft)\n\n* [How I made $31500 by submitting a bug to Facebook](https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204)\n\n* [The road from sandboxed SSTI to SSRF and XXE](https://www.reddit.com/r/Slackers/comments/g6pt8t/the_road_from_sandboxed_ssti_to_ssrf_and_xxe/)\n\n* [Exploiting SSRF in RethinkDB](https://medium.com/@d3fl4t3/exploiting-ssrf-in-rethinkdb-38a5a5438fb7)\n\n* [Blind SSRF - Sentry Misconfiguration](https://shahjerry33.medium.com/blind-ssrf-sentry-misconfiguration-a68edc789db2)\n\n* [Exploiting an SSRF: Trials and Tribulations](https://medium.com/a-bugz-life/exploiting-an-ssrf-trials-and-tribulations-14c5d8dbd69a)\n\n* [Blind SSRF exploitation](https://lab.wallarm.com/blind-ssrf-exploitation/)\n\n* [31k$ SSRF in Google Cloud Monitoring](https://nechudav.blogspot.com/2020/11/31k-ssrf-in-google-cloud-monitoring.html?m=1)\n\n* [Tale of 3 vulnerabilities to account takeover!](https://logicbomb.medium.com/tale-of-3-vulnerabilities-to-account-takeover-44ba631a0304)\n\n* [An unknown Linux secret that turned SSRF to OS Command injection](https://secureitmania.medium.com/an-unknown-linux-secret-that-turned-ssrf-to-os-command-injection-6fe2f4edc202)\n\n* [SSRF inside Google production network](https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/)\n\n* [Pivoting from blind SSRF to RCE with HashiCorp Consul](https://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html)\n\n* [Hunting Headers for SSRF](https://speakerdeck.com/aditya45/hunting-headers-for-ssrf?slide=16)\n\n* [WRITE UP – GOOGLE VRP N/A: SSRF BYPASS WITH QUADZERO IN GOOGLE CLOUD MONITORING](https://omespino.com/write-up-google-vrp-n-a-ssrf-bypass-with-quadzero-in-google-cloud-monitoring/)\n\n* [Escalating SSRF to RCE](https://sanderwind.medium.com/escalating-ssrf-to-rce-7c0147371c40)\n\n* [GITLAB — Server Side Request Forgery in “Project Import” page.](https://ltsirkov.medium.com/gitlab-server-side-request-forgery-in-project-import-page-6fdb9ef423e4)\n\n* [SSRF’s up! Real World Server-Side Request Forgery (SSRF)](https://www.shorebreaksecurity.com/blog/ssrfs-up-real-world-server-side-request-forgery-ssrf/)\n\n* [SSRF - Server Side Request Forgery (Types and ways to exploit it) Part-1](https://medium.com/@madrobot/ssrf-server-side-request-forgery-types-and-ways-to-exploit-it-part-1-29d034c27978)\n\n* [Weaponizing BURP to work as an evil SSRF Confluence Server.](https://medium.com/@Master_SEC/weaponizing-burp-to-work-as-an-evil-ssrf-confluence-server-e077d71b4ef2)\n\n* [Google VRP SSRF in Google Cloud Platform StackDriver](https://ngailong.wordpress.com/2019/12/19/google-vrp-ssrf-in-google-cloud-platform-stackdriver/)\n\n* [Vimeo upload function SSRF](https://medium.com/@dPhoeniixx/vimeo-upload-function-ssrf-7466d8630437)\n\n* [SSRF via FFmpeg HLS processing](https://medium.com/@pflash0x0punk/ssrf-via-ffmpeg-hls-processing-a04e0288a8c5)\n\n* [My First SSRF Using DNS Rebinding](https://geleta.eu/2019/my-first-ssrf-using-dns-rebinfing/)\n\n* [BugBounty | A Simple SSRF](https://jinone.github.io/bugbounty-a-simple-ssrf/)\n\n* [ssrf reading local files](https://www.openbugbounty.org/blog/leonmugen/ssrf-reading-local-files-from-downnotifier-server/)\n\n* [An Accidental SSRF Honeypot in Google Calendar](https://www.komodosec.com/post/an-accidental-ssrf-honeypot-in-google-calendar)\n\n* [Gain adfly SMTP access with SSRF via Gopher Protocol](https://medium.com/@androgaming1912/gain-adfly-smtp-access-with-ssrf-via-gopher-protocol-26a26d0ec2cb)\n\n* [SVG XLink SSRF fingerprinting libraries version](https://medium.com/@arbazhussain/svg-xlink-ssrf-fingerprinting-libraries-version-450ebecc2f3c)\n\n* [Server Side Request Forgery(SSRF){port issue hidden approch }](https://medium.com/@w_hat_boy/server-side-request-forgery-ssrf-port-issue-hidden-approch-f4e67bd8cc86)\n\n* [The journey of Web Cache + Firewall Bypass to SSRF to AWS credentials compromise!](https://logicbomb.medium.com/the-journey-of-web-cache-firewall-bypass-to-ssrf-to-aws-credentials-compromise-b250fb40af82)\n\n* [Ssrf to Read Local Files and Abusing the AWS metadata](https://medium.com/@pratiky054/ssrf-to-read-local-files-and-abusing-the-aws-metadata-8621a4bf382)\n\n* [From SSRF To RCE in PDFReacter](https://medium.com/@armaanpathan/pdfreacter-ssrf-to-root-level-local-file-read-which-led-to-rce-eb460ffb3129)\n\n* [SSRF vulnerability via FFmpeg HLS processing](https://medium.com/@valeriyshevchenko/ssrf-vulnerability-via-ffmpeg-hls-processing-f3823c16f3c7)\n \n* [Escalating SSRF to RCE](https://generaleg0x01.com/2019/03/10/escalating-ssrf-to-rce/)\n\n* [Vimeo SSRF with code execution potential.](https://infosecwriteups.com/vimeo-ssrf-with-code-execution-potential-68c774ba7c1e)\n\n* [Unauthenticated Blind SSRF in Oracle EBS](https://medium.com/@x41x41x41/unauthenticated-ssrf-in-oracle-ebs-765bd789a145)\n\n* [$1.000 SSRF in Slack](https://elbs.medium.com/1-000-ssrf-in-slack-7737935d3884)\n\n* [Exploiting SSRF in AWS Elastic Beanstalk](https://notsosecure.com/exploiting-ssrf-in-aws-elastic-beanstalk/)\n\n\n\n\n## HackerOne Reports 💻\n\n* [SSRF in imgur video GIF conversion](https://hackerone.com/reports/247680)\n\n* [Full Read SSRF on Gitlab's Internal Grafana](https://hackerone.com/reports/878779)\n\n* [SSRF protection bypass](https://hackerone.com/reports/736867)\n\n* [SSRF on project import via the remote_attachment_url on a Note](https://hackerone.com/reports/826361)\n\n* [Blind SSRF on debug.nordvpn.com due to misconfigured sentry instance](https://hackerone.com/reports/756149)\n\n* [Blind SSRF on errors.hackerone.net due to Sentry misconfiguration](https://hackerone.com/reports/374737)\n\n* [SSRF PDF documentconverterws](https://hackerone.com/reports/361793)\n\n* [Blind SSRF on https://labs.data.gov/dashboard/Campaign/json_status/ Endpoint](https://hackerone.com/reports/895696)\n\n* [SSRF In Get Video Contents](https://hackerone.com/reports/643622)\n\n* [SSRF in webhooks leads to AWS private keys disclosure](https://hackerone.com/reports/508459)\n\n* [SSRF - RSS feed, blacklist bypass (IP Formatting)](https://hackerone.com/reports/299130)\n\n* [SSRF](https://hackerone.com/reports/296045)\n\n* [SSRF in CI after first run](https://hackerone.com/reports/369451)\n\n* [SSRF in Exchange leads to ROOT access in all instances](https://hackerone.com/reports/341876)\n\n* [SSRF in api.slack.com, using slash commands and bypassing the protections.](https://hackerone.com/reports/381129)\n\n## PayloadsAllTheThings / Server Side Request Forgery / 🚀\n\n- [PayloadsAllTheThings / Server Side Request Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMustafaSky%2FGuide-to-SSRF","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FMustafaSky%2FGuide-to-SSRF","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FMustafaSky%2FGuide-to-SSRF/lists"}