domains / families / security / ssrf-server-side-request-forgery

ssrf-server-side-request-forgery

separate

SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.

When to use

• URL filter bypass
• cloud metadata endpoint exploitation
• protocol exploitation
• blind SSRF detection
• chaining to RCE
• finding SSRF surface
• basic confirmation methodology
• host validation bypass

When not to use

• real-world CVE chains
• DNS Rebinding deep dives
• K8s SSRF
• SSRF to Redis to RCE full exploitation

Skill page

Source