Skip to content
BackEsc
Connect AISign inSign up free

Server Side Request Forgery · passage 15 of 53

Bypass Using TLD localhost

1 code block · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

There was a reserved tld called `.localhost`, it can accept arbiratry domains and resolves to the localhost ip, here is an example

$ ping PayloadsAllTheThings.localhost -c 1
PING PayloadsAllTheThings.localhost (::1) 56 data bytes
64 bytes from ip6-localhost (::1): icmp_seq=1 ttl=64 time=0.070 ms

--- PayloadsAllTheThings.localhost ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.070/0.070/0.070/0.000 ms

Source: Server Side Request Forgery/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Server-Side Request Forgery§ 1text · README.md
  2. Methodology§ 22 code blocks · README.md
  3. Default Targets§ 3text · README.md
  4. Bypass Localhost with IPv6 Notation§ 4text · README.md
  5. Bypass Localhost with a Domain Redirect§ 51 code block · README.md
  6. Bypass Localhost with CIDR§ 61 code block · README.md
  7. Bypass Using Rare Address§ 71 code block · README.md
  8. Bypass Using an Encoded IP Address§ 8text · README.md
  9. Bypass Using Different Encoding§ 9text · README.md
  10. Bypassing via ipv6 hostname§ 10text · README.md
  11. Bypassing Using a Redirect§ 11text · README.md
  12. Bypass Using DNS Rebinding§ 122 code blocks · README.md
  13. Bypass Abusing URL Parsing Discrepancy§ 131 code block · README.md
  14. Bypass PHP filtervar() Function§ 141 code block · README.md
  15. Bypass Using TLD localhost§ 151 code block · README.md
  16. Bypass Using JAR Scheme§ 161 code block · README.md
  17. File§ 171 code block · README.md
  18. HTTP§ 181 code block · README.md
  19. Dict§ 191 code block · README.md
  20. SFTP§ 201 code block · README.md
  21. TFTP§ 211 code block · README.md
  22. LDAP§ 221 code block · README.md
  23. Netdoc§ 231 code block · README.md
  24. Gopher§ 242 code blocks · README.md
  25. Blind Exploitation§ 25text · README.md
  26. Upgrade to XSS§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated