Server-Side Request Forgery · payload topic
Server Side Request Forgery
53 passages · 56 code blocks
Every mark is a titled passage of this topic's pages, in reading order; the brighter ones carry code. For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open Server Side Request Forgery on GitHubServer Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.
Source: PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.
- Server-Side Request Forgery
- Methodology
- Default Targets
- Bypass Localhost with IPv6 Notation
- Bypass Localhost with a Domain Redirect
- Bypass Localhost with CIDR
- Bypass Using Rare Address
- Bypass Using an Encoded IP Address
- Bypass Using Different Encoding
- Bypassing via ipv6 hostname
- Bypassing Using a Redirect
- Bypass Using DNS Rebinding
- Bypass Abusing URL Parsing Discrepancy
- Bypass PHP filtervar() Function
- Bypass Using TLD localhost
- Bypass Using JAR Scheme
- File
- HTTP
- Dict
- SFTP
- TFTP
- LDAP
- Netdoc
- Gopher
- Blind Exploitation
- Upgrade to XSS
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP