Skip to content
BackEsc
Connect AISign inSign up free

Server Side Request Forgery · passage 25 of 53

Blind Exploitation

Text · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

> When exploiting server-side request forgery, we can often find ourselves in a position where the response cannot be read. Use an SSRF chain to gain an Out-of-Band output: [assetnote/blind-ssrf-chains](https://github.com/assetnote/blind-ssrf-chains) **Possible via HTTP(s)**: * [Elasticsearch](https://github.com/assetnote/blind-ssrf-chains#elasticsearch) * [Weblogic](https://github.com/assetnote/blind-ssrf-chains#weblogic) * [Hashicorp Consul](https://github.com/assetnote/blind-ssrf-chains#consul) * [Shellshock](https://github.com/assetnote/blind-ssrf-chains#shellshock) * [Apache Druid](https://github.com/assetnote/blind-ssrf-chains#druid) * [Apache Solr](https://github.com/assetnote/blind-ssrf-chains#solr) * [PeopleSoft](https://github.com/assetnote/blind-ssrf-chains#peoplesoft) * [Apache Struts](https://github.com/assetnote/blind-ssrf-chains#struts) * [JBoss](https://github.com/assetnote/blind-ssrf-chains#jboss) * [Confluence](https://github.com/assetnote/blind-ssrf-chains#confluence) * [Jira](https://github.com/assetnote/blind-ssrf-chains#jira) * [Other Atlassian Products](https://github.com/assetnote/blind-ssrf-chains#atlassian-products) * [OpenTSDB](https://github.com/assetnote/blind-ssrf-chains#opentsdb) * [Jenkins](https://github.com/assetnote/blind-ssrf-chains#jenkins) * [Hystrix Dashboard](https://github.com/assetnote/blind-ssrf-chains#hystrix) * [W3 Total Cache](https://github.com/assetnote/blind-ssrf-chains#w3) * [Docker](https://github.com/assetnote/blind-ssrf-chains#docker) * [Gitlab Prometheus Redis Exporter](https://github.com/assetnote/blind-ssrf-chains#redisexporter) **Possible via Gopher**: * [Redis](https://github.com/assetnote/blind-ssrf-chains#redis) * [Memcache](https://github.com/assetnote/blind-ssrf-chains#memcache) * [Apache Tomcat](https://github.com/assetnote/blind-ssrf-chains#tomcat)

Source: Server Side Request Forgery/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Server-Side Request Forgery§ 1text · README.md
  2. Methodology§ 22 code blocks · README.md
  3. Default Targets§ 3text · README.md
  4. Bypass Localhost with IPv6 Notation§ 4text · README.md
  5. Bypass Localhost with a Domain Redirect§ 51 code block · README.md
  6. Bypass Localhost with CIDR§ 61 code block · README.md
  7. Bypass Using Rare Address§ 71 code block · README.md
  8. Bypass Using an Encoded IP Address§ 8text · README.md
  9. Bypass Using Different Encoding§ 9text · README.md
  10. Bypassing via ipv6 hostname§ 10text · README.md
  11. Bypassing Using a Redirect§ 11text · README.md
  12. Bypass Using DNS Rebinding§ 122 code blocks · README.md
  13. Bypass Abusing URL Parsing Discrepancy§ 131 code block · README.md
  14. Bypass PHP filtervar() Function§ 141 code block · README.md
  15. Bypass Using TLD localhost§ 151 code block · README.md
  16. Bypass Using JAR Scheme§ 161 code block · README.md
  17. File§ 171 code block · README.md
  18. HTTP§ 181 code block · README.md
  19. Dict§ 191 code block · README.md
  20. SFTP§ 201 code block · README.md
  21. TFTP§ 211 code block · README.md
  22. LDAP§ 221 code block · README.md
  23. Netdoc§ 231 code block · README.md
  24. Gopher§ 242 code blocks · README.md
  25. Blind Exploitation§ 25text · README.md
  26. Upgrade to XSS§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated