Skip to content
BackEsc
Connect AISign inSign up free

Server Side Request Forgery · passage 24 of 53

Gopher

2 code blocks · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

The `gopher://` protocol is a lightweight, text-based protocol that predates the modern World Wide Web. It was designed for distributing, searching, and retrieving documents over the Internet.

gopher://[host]:[port]/[type][selector]

This scheme is very useful as it as be used to send data to TCP protocol.

gopher://localhost:25/_MAIL%20FROM:<attacker@example.com>%0D%0A

Refer to the SSRF Advanced Exploitation to explore the `gopher://` protocol deeper.

Source: Server Side Request Forgery/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Server-Side Request Forgery§ 1text · README.md
  2. Methodology§ 22 code blocks · README.md
  3. Default Targets§ 3text · README.md
  4. Bypass Localhost with IPv6 Notation§ 4text · README.md
  5. Bypass Localhost with a Domain Redirect§ 51 code block · README.md
  6. Bypass Localhost with CIDR§ 61 code block · README.md
  7. Bypass Using Rare Address§ 71 code block · README.md
  8. Bypass Using an Encoded IP Address§ 8text · README.md
  9. Bypass Using Different Encoding§ 9text · README.md
  10. Bypassing via ipv6 hostname§ 10text · README.md
  11. Bypassing Using a Redirect§ 11text · README.md
  12. Bypass Using DNS Rebinding§ 122 code blocks · README.md
  13. Bypass Abusing URL Parsing Discrepancy§ 131 code block · README.md
  14. Bypass PHP filtervar() Function§ 141 code block · README.md
  15. Bypass Using TLD localhost§ 151 code block · README.md
  16. Bypass Using JAR Scheme§ 161 code block · README.md
  17. File§ 171 code block · README.md
  18. HTTP§ 181 code block · README.md
  19. Dict§ 191 code block · README.md
  20. SFTP§ 201 code block · README.md
  21. TFTP§ 211 code block · README.md
  22. LDAP§ 221 code block · README.md
  23. Netdoc§ 231 code block · README.md
  24. Gopher§ 242 code blocks · README.md
  25. Blind Exploitation§ 25text · README.md
  26. Upgrade to XSS§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated