Testing playbook · advanced
SSRF Hunting
Find server-side request forgery, then pivot to metadata and internal services.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Find request-issuing features
Webhooks, URL previews, PDF/image fetchers, import-from-URL, and SSO metadata endpoints all fetch server-side.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Set up OOB detection
Use an interaction server to catch blind SSRF via DNS/HTTP callbacks.
interactsh-client -vEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Point inward
Try localhost, link-local, and cloud metadata. Rotate encodings/redirects to beat naive filters.
curl 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/'Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Escalate
Cloud metadata → credentials; internal ports → admin panels and unauth services.
nuclei -u https://target.com -t http/vulnerabilities/ -tags ssrfEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- Bypass filters with decimal/hex IPs, IPv6, DNS rebinding, and open redirects.
- Always pair with OOB - many SSRFs are blind.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.