Skip to content
BackEsc
Connect AISign inSign up free

Server Side Request Forgery · passage 4 of 53

Bypass Localhost with IPv6 Notation

Text · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Connect AI

Open this passage on GitHub

* Using unspecified address in IPv6 `[::]` ```powershell http://[::]:80/ ``` * Using IPv6 loopback addres`[0000::1]` ```powershell http://[0000::1]:80/ ``` * Using [IPv6/IPv4 Address Embedding](http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding.htm) ```powershell http://[0:0:0:0:0:ffff:127.0.0.1] http://[::ffff:127.0.0.1] ```

Source: Server Side Request Forgery/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

  1. Server-Side Request Forgery§ 1text · README.md
  2. Methodology§ 22 code blocks · README.md
  3. Default Targets§ 3text · README.md
  4. Bypass Localhost with IPv6 Notation§ 4text · README.md
  5. Bypass Localhost with a Domain Redirect§ 51 code block · README.md
  6. Bypass Localhost with CIDR§ 61 code block · README.md
  7. Bypass Using Rare Address§ 71 code block · README.md
  8. Bypass Using an Encoded IP Address§ 8text · README.md
  9. Bypass Using Different Encoding§ 9text · README.md
  10. Bypassing via ipv6 hostname§ 10text · README.md
  11. Bypassing Using a Redirect§ 11text · README.md
  12. Bypass Using DNS Rebinding§ 122 code blocks · README.md
  13. Bypass Abusing URL Parsing Discrepancy§ 131 code block · README.md
  14. Bypass PHP filtervar() Function§ 141 code block · README.md
  15. Bypass Using TLD localhost§ 151 code block · README.md
  16. Bypass Using JAR Scheme§ 161 code block · README.md
  17. File§ 171 code block · README.md
  18. HTTP§ 181 code block · README.md
  19. Dict§ 191 code block · README.md
  20. SFTP§ 201 code block · README.md
  21. TFTP§ 211 code block · README.md
  22. LDAP§ 221 code block · README.md
  23. Netdoc§ 231 code block · README.md
  24. Gopher§ 242 code blocks · README.md
  25. Blind Exploitation§ 25text · README.md
  26. Upgrade to XSS§ 261 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Sign inSign up free

Updated