Server Side Request Forgery · passage 11 of 53

Bypassing Using a Redirect

Text · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

1. Create a page on a whitelisted host that redirects requests to the SSRF the target URL (e.g. 192.168.0.1) 2. Launch the SSRF pointing to `vulnerable.com/index.php?url=http://redirect-server` 3. You can use response codes [HTTP 307](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307) and [HTTP 308](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/308) in order to retain HTTP method and body after the redirection. To perform redirects without hosting own redirect server or perform seemless redirect target fuzzing, use [Horlad/r3dir](https://github.com/Horlad/r3dir). * Redirects to `http://localhost` with `307 Temporary Redirect` status code ```powershell https://307.r3dir.me/--to/?url=http://localhost ``` * Redirects to `http://169.254.169.254/latest/meta-data/` with `302 Found` status code ```powershell https://62epax5fhvj3zzmzigyoe5ipkbn7fysllvges3a.302.r3dir.me ```

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.