Server Side Request Forgery (SSRF)

SSRF is a vulnerability that lets an attacker send requests on behalf of a server. During an SSRF, attackers forge the request signatures of the vulnerable server, allowing them to assume a privileged position on a network, bypass firewall controls, and gain access to internal services.

Hunt for SSRFs

1. Spot the features prone to SSRFs and take notes for future reference.
2. Set up a callback listener to detect blind SSRFs by using an online service, Netcat, Burp's Collaborative features.
3. Provide the potentially vulnerable endpoints with common internal addresses or the address of your callback listeners.
4. Check if hte server responds with information that confirms the SSRF. Or, in the case of a blind SSRF, check your server logs for requests from the target server.
5. In the case of a blind SSRF, check if the server behavior differs when you request different hosts or ports.
6. If SSRF protection is implemented, try to bypass it by using different strategies (see book).
7. Pick a tactic to escalate SSRF.