Server Side Request Forgery · passage 16 of 53

Bypass Using JAR Scheme

1 code block · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

This attack technique is fully blind, you won't see the result.

jar:scheme://domain/path!/ 
jar:http://127.0.0.1!/
jar:https://127.0.0.1!/
jar:ftp://127.0.0.1!/

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

Server-Side Request Forgery§ 1text · README.md
Methodology§ 22 code blocks · README.md
Default Targets§ 3text · README.md
Bypass Localhost with IPv6 Notation§ 4text · README.md
Bypass Localhost with a Domain Redirect§ 51 code block · README.md
Bypass Localhost with CIDR§ 61 code block · README.md
Bypass Using Rare Address§ 71 code block · README.md
Bypass Using an Encoded IP Address§ 8text · README.md
Bypass Using Different Encoding§ 9text · README.md
Bypassing via ipv6 hostname§ 10text · README.md
Bypassing Using a Redirect§ 11text · README.md
Bypass Using DNS Rebinding§ 122 code blocks · README.md
Bypass Abusing URL Parsing Discrepancy§ 131 code block · README.md
Bypass PHP filtervar() Function§ 141 code block · README.md
Bypass Using TLD localhost§ 151 code block · README.md
Bypass Using JAR Scheme§ 161 code block · README.md
File§ 171 code block · README.md
HTTP§ 181 code block · README.md
Dict§ 191 code block · README.md
SFTP§ 201 code block · README.md
TFTP§ 211 code block · README.md
LDAP§ 221 code block · README.md
Netdoc§ 231 code block · README.md
Gopher§ 242 code blocks · README.md
Blind Exploitation§ 25text · README.md
Upgrade to XSS§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.