Skip to content
ssrf.payloads

Series

Server-Side Request Forgery, end to end

3 posts in this series. Read them in order or jump to any one.

  1. SSRF Payload Cheat Sheet: Encodings, Bypasses, and What Actually Lands

    A working SSRF payload list from real engagements: IP encoding tricks, allow-list bypasses, protocol smuggling, and the cloud metadata endpoints worth memorizing.

  2. SSRF Filter Bypass: Beating Allow-Lists, Blocklists, and Parser Mismatches

    Why SSRF filters fail in practice. Parser confusion, IP encoding, DNS rebinding, and redirect chains explained from the attacker's side, with the defensive fixes that actually hold.

  3. Exploiting Cloud Metadata via SSRF: 169.254.169.254 on AWS, GCP, and Azure

    How SSRF turns into stolen cloud credentials through the 169.254.169.254 metadata endpoint. IMDSv1 vs IMDSv2, the GCP header requirement, Azure quirks, and why IMDSv2 still gets popped.

All posts in this series

SSRF Payload Cheat Sheet: Encodings, Bypasses, and What Actually Lands
A working SSRF payload list from real engagements: IP encoding tricks, allow-list bypasses, protocol smuggling, and the cloud metadata endpoints worth memorizing.
ssrfpayloadsweb-securitypentesting
SSRF Filter Bypass: Beating Allow-Lists, Blocklists, and Parser Mismatches
Why SSRF filters fail in practice. Parser confusion, IP encoding, DNS rebinding, and redirect chains explained from the attacker's side, with the defensive fixes that actually hold.
ssrffilter-bypassweb-securitypentesting
Exploiting Cloud Metadata via SSRF: 169.254.169.254 on AWS, GCP, and Azure
How SSRF turns into stolen cloud credentials through the 169.254.169.254 metadata endpoint. IMDSv1 vs IMDSv2, the GCP header requirement, Azure quirks, and why IMDSv2 still gets popped.
ssrfcloud-securityawsimds