Server Side Request Forgery · passage 2 of 53

Methodology

2 code blocks · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

SSRF is a security vulnerability that occurs when an attacker manipulates a server to make HTTP requests to an unintended location. This happens when the server processes user-provided URLs or IP addresses without proper validation. Common exploitation paths: * Accessing Cloud metadata * Leaking files on the server * Network discovery, port scanning with the SSRF * Sending packets to specific services on the network, usually to achieve a Remote Command Execution on another server **Example**: A server accepts user input to fetch a URL.

url = input("Enter URL:")
response = requests.get(url)
return response

An attacker supplies a malicious input:

http://169.254.169.254/latest/meta-data/

This fetches sensitive information from the AWS EC2 metadata service.

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.