Server Side Request Forgery · passage 3 of 53

Default Targets

Text · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

By default, Server-Side Request Forgery are used to access services hosted on `localhost` or hidden further on the network. * Using `localhost`

  http://localhost:80
  http://localhost:22
  https://localhost:443

* Using `127.0.0.1`

  http://127.0.0.1:80
  http://127.0.0.1:22
  https://127.0.0.1:443

* Using `0.0.0.0`

  http://0.0.0.0:80
  http://0.0.0.0:22
  https://0.0.0.0:443

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.