appsec.fyi

Server-Side Request Forgery (SSRF) Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Server-Side Request Forgery (SSRF)

In a Server-Side Request Forgery (SSRF) attack, the attacker abuses functionality on the server to read or update internal resources. By supplying or modifying a URL that the server-side code processes, the attacker can reach internal services, read cloud metadata, and access systems that are not exposed to the internet.

SSRF has become one of the highest-impact vulnerability classes in modern cloud environments. Accessing the cloud metadata endpoint (http://169.254.169.254) from an SSRF can yield temporary IAM credentials, leading to full cloud account compromise. Even in non-cloud environments, SSRF enables port scanning of internal networks, accessing internal admin panels, and reaching databases or caches that trust requests from localhost.

Attackers use a wide range of bypass techniques to defeat SSRF filters: DNS rebinding, IP address encoding variations (decimal, octal, hex), URL parser inconsistencies, IPv6 representations, and redirect chains. Partial SSRF — where the attacker controls only part of the URL — can still be exploitable through open redirects or URL fragment abuse.

SSRF commonly appears in webhook integrations, URL preview features, PDF generators, image processors, and any functionality that fetches remote resources on behalf of the user.

This page collects SSRF research, bypass techniques, cloud exploitation methods, and real-world writeups from bug bounty programs and security research.

From OWASP

Date Added Link Excerpt
2026-05-02 NEW 2026Advanced SSRF bypass techniques include decimal IP encoding and hexadecimal formats. DNS rebinding and parser differences can bypass filters effectively. Protocols like gopher enable deeper exploitation scenarios. #BugBounty #SSRF #CyberSecurity #HackingAdvanced SSRF bypass techniques include decimal IP encoding and hexadecimal formats. DNS rebinding and parser differences can bypass filters effectively. Protocols like gopher enable deeper exploitati...
2026-05-01 NEW 2026SSRF combined with cloud metadata access leads to high impact vulnerabilities. AWS metadata endpoints expose temporary credentials for IAM roles. These credentials can lead to full cloud compromise if exploited. #BugBounty #CloudSecurity #SSRF #CyberSecuritySSRF combined with cloud metadata access leads to high impact vulnerabilities.  AWS metadata endpoints expose temporary credentials for IAM roles.  These credentials can lead to full cloud compromise ...
2026-05-01 NEW 2026How Escape AI Pentesting Exploited SSRF in LiteLLMHow Escape AI Pentesting Exploited SSRF in LiteLLM https://ift.tt/jPXKkrJ → securityboulevard.com
2026-05-01 NEW 2026pic.pic. https://ift.tt/t284rfm
2026-04-29 NEW 2026Nginx-UI SSRF (GHSA-wr32-99hh-6f35) CVSS 8.5 Authenticated users can access internal services & metadata endpoints potential RCE chain. #SSRF #CVE newsNginx-UI is vulnerable to a critical Server-Side Request Forgery (SSRF) vulnerability (GHSA-wr32-99hh-6f35) with a CVSS score of 8.5. Authenticated users can exploit this flaw to access internal services and metadata endpoints. This could potentially lead to a Remote Code Execution (RCE) chain.
2026-04-29 NEW 2026CVE-2026-33626: Critical SSRF Vulnerability in LMDeploy Rapidly Exploited in the Wild Technical Analysis and Mitigation Guide newsAnalysis of CVE-2026-33626 details a critical Server-Side Request Forgery (SSRF) vulnerability in LMDeploy, exploited rapidly in the wild. This flaw, affecting versions up to 0.12.0 with vision-language support, allows attackers to fetch arbitrary URLs, leading to the exfiltration of cloud metadata, probing of internal services like Redis and MySQL, and network reconnaissance. Exploitation attempts utilized callback infrastructure such as cw2mhnbd.requestrepo.com, originating from IP 103.116.72.119. Mitigation involves upgrading LMDeploy, enforcing IMDSv2, restricting egress, and implementing runtime detection of suspicious outbound connections. → rescana.com
2026-04-28 NEW 2026Already cycled through 400 vectors. Looking for a wizard to bypass this response filtering or pivot via OOB exfiltration. #BugBounty #InfoSec #SSRF #RedTeam #CyberSecurity intermediateA security researcher is seeking assistance with a bug bounty challenge, having exhausted over 400 vectors to bypass response filtering or achieve Out-of-Band (OOB) exfiltration. They are looking for an expert ("wizard") to help crack this particular vulnerability. The post is tagged with #BugBounty, #InfoSec, #SSRF, #RedTeam, and #CyberSecurity, indicating the context of a bug bounty program and the nature of the security testing involved. No specific payout amount is mentioned.
2026-04-28 NEW 2026To be clear: this is a "gov-related" scope. I strictly follow the program's terms and will not disclose anything further publicly. I am only seeking assistance to find an optimal bypass for the response filtering. #BugBounty #InfoSec #SSRF #CyberSecurity intermediateA cybersecurity professional is seeking help within a bug bounty program focused on a government-related scope. They emphasize adherence to program terms and will not publicly disclose details. Their primary objective is to find an optimal bypass for response filtering, suggesting a focus on Server-Side Request Forgery (SSRF) vulnerabilities. No payout amount is mentioned.
2026-04-28 NEW 2026SSRF Hunter Challenge | ive got a 100% functional Open SSRF on a high-value target. WAF bypassed via Decimal IP encoding but i'm hitting a wall: the response body is strictly filtered/stripped by egress inspection.#BugBounty #InfoSec #SSRF #RedTeam #CyberSecurity intermediateA security researcher has achieved a functional Open SSRF on a high-value target, successfully bypassing WAF using Decimal IP encoding. However, they are facing a challenge as the response body is heavily filtered by egress inspection. The researcher shared this experience as part of an #SSRF Hunter Challenge on social media, seeking solutions or insights from the #BugBounty and #InfoSec communities. No payout amount was specified.
2026-04-27 NEW 2026Old but gold. #SSRF = #LFD intermediateThis content highlights a security vulnerability where Server-Side Request Forgery (SSRF) can be exploited to achieve Local File Disclosure (LFD). The accompanying link likely details a specific instance or method of this combined attack. No bug bounty payout amount is mentioned.
2026-04-27 NEW 2026NEW THREAT INTEL: LMDeploy SSRF (CVE-2026-33626) - Unauth SSRF in load_image() coerces AI inference servers to fetch arbitrary URLs. Exploited 13h after disclosure. 9 detections 18 IOCs. #ThreatIntel #CyberSecurity #SSRF #AISecurity pic. newsA critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-33626, has been discovered in LMDeploy's `load_image()` function. This vulnerability allows unauthenticated attackers to force AI inference servers to fetch arbitrary URLs, posing a significant security risk. The exploit was observed in the wild just 13 hours after its disclosure, indicating its severity and immediate impact. Security teams have identified 9 detections and 18 Indicators of Compromise (IOCs) related to this threat.
2026-04-27 NEW 2026If an app fetched PDFs via ?url= classic SSRF setup. Bypass? Enumerate internal PDF subdomains. Swap the file ID other users' docs. SSRF IDOR chained. #bugbounty #SSRF intermediateThis bug bounty report details a chained SSRF (Server-Side Request Forgery) and IDOR (Insecure Direct Object Reference) vulnerability. The flaw arises when an application fetches PDFs using a `?url=` parameter, a common SSRF setup. Attackers can potentially bypass security measures to enumerate internal PDF subdomains. By manipulating the file ID, they can access documents belonging to other users. This combination of SSRF and IDOR creates a significant security risk.
2026-04-26 NEW 2026A critical LMDeploy SSRF vulnerability exploitation campaign launched under 13 hours after disclosure. #SSRF #CVE #AIsecurity #LLMsecurity #Sysdig #ActiveExploitation #CloudSecurity #GenAI #InfoSec pic. newsA critical Server-Side Request Forgery (SSRF) vulnerability in LMDeploy was actively exploited within 13 hours of its disclosure. This indicates a rapid threat response by attackers, highlighting the immediate risks associated with newly revealed vulnerabilities in AI and LLM security. The exploitation underscores the importance of swift patching and security measures in cloud and AI environments.
2026-04-24 2026LMDeploy SSRF alert CVE-2026-33626 exploited within hours Attackers can access internal services & cloud metadata. Update now & restrict outbound requests.vulert.com/blog/lmdeploy-p #CyberSecurity #SSRF #AIsecurity #Vulert news🚨 LMDeploy SSRF alert CVE-2026-33626 exploited within hours ⚠️ Attackers can access internal services & cloud metadata. Update now & restrict outbound requests.vulert.com/blog/lmdeploy-…p #CyberSecuri...
2026-04-24 2026LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure newsLibrary that facilitates the deployment and serving of large language models, LMDeploy, is vulnerable to CVE-2026-33626, a high-severity Server-Side Request Forgery (SSRF) flaw. This vulnerability, discovered by Igor Stepansky and observed being exploited by Sysdig within 13 hours of disclosure, allows attackers to fetch arbitrary URLs via the `load_image()` function in `lmdeploy/vl/utils.py`. Exploitation can lead to accessing cloud metadata services, internal networks, sensitive data, and port scanning of internal systems, as demonstrated by active attempts against AWS IMDS and Redis. → thehackernews.com
2026-04-23 2026Attackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory newsAttackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory https://ift.tt/xWknlfA → gbhackers.com
2026-04-23 2026CVE-2026-33626 exposes an SSRF in LMDeploys vision-language image loader. Attackers accessed AWS IMDS scanned local services and confirmed egress within 12 hours. Update to v0.12.3 and enforce IMDSv2. #LMDeploy #SSRF #USA ift.tt/PVn3XMk newsCVE-2026-33626 exposes an SSRF in LMDeploy’s vision-language image loader. Attackers accessed AWS IMDS, scanned local services, and confirmed egress within 12 hours. Update to v0.12.3 and enforce IMDS...
2026-04-23 2026CVE-2026-33626: A critical SSRF in LMDeploy exploited in under 13 hours. Learn how attackers hijack AI nodes and how to secure your inference cloud now. #CVE202633626 #SSRF #AISecurity #LMDeploy #InfoSec #CyberAttack #CloudSecurity #LLM #PatchNow securityonline.info/cve-2026-33626 pic.x.com/09IZxf21rQ newsCVE-2026-33626: A critical SSRF in LMDeploy exploited in under 13 hours. Learn how attackers hijack AI nodes and how to secure your inference cloud now. #CVE202633626 #SSRF #AISecurity #LMDeploy #Info...
2026-04-22 2026Critical Spring Authorization Server Issue Exposes Systems to XSS and SSRF Attacks newsCritical Spring Authorization Server Issue Exposes Systems to XSS and SSRF Attacks https://ift.tt/y4laiIW → gbhackers.com
2026-04-22 2026Critical Spring Authorization Server Flaw Enables XSS Privilege Escalation and SSRF newsCritical Spring Authorization Server Flaw Enables XSS, Privilege Escalation, and SSRF https://ift.tt/b2pauUc → cyberpress.org
2026-04-22 2026LibreChat SSRF Bypass via IPv6 Mapped Address Confusion intermediateWriteup of CVE-2026-31943 in LibreChat details a Server-Side Request Forgery bypass where authenticated users can exploit the `isPrivateIP()` function's failure to detect hex-normalized IPv4-mapped IPv6 addresses. This allows the LibreChat server to send HTTP requests to internal network resources, including cloud metadata services and loopback addresses, undermining SSRF protections. Versions prior to 0.8.3 are affected. → thehackerwire.com
2026-04-22 2026SSRF Vulnerability: Bypassing Protection with DNS Rebinding Attack intermediateWriteup detailing CVE-2025-69660, a Server-Side Request Forgery (SSRF) vulnerability in simstudioai/sim's proxy and file parsing APIs. The writeup explains how this SSRF could be bypassed using a DNS rebinding attack, specifically by exploiting a time-of-check-to-time-of-use (TOCTOU) vulnerability. It further details the fix implemented by the development team, DNS pinning, which resolves hostnames to IP addresses once to prevent subsequent malicious rebinding.
2026-04-22 2026is-localhost-ip 2.0.0 SSRF via Restrictions Bypass (CVE-2025-9960) newsLibrary is-localhost-ip 2.0.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability due to a bypass of its localhost restrictions. The library misclassifies IPv6-mapped IPv4 addresses like ::ffff:127.0.0.1 and certain private/link-local IP ranges as localhost, incorrectly expanding the trust boundary. This allows attackers to target internal services by crafting requests that exploit these misclassifications, as documented in CVE-2025-9960.
2026-04-22 2026See-SURF: Tool to Find Potential Vulnerable SSRF Parameters beginnerTool for detecting Server-Side Request Forgery (SSRF) vulnerabilities. See-SURF automates reconnaissance by crawling web applications, parsing Burp Suite sitemaps, and identifying potential SSRF parameters using regex. It incorporates AI-powered validation with providers like Google Gemini and OpenAI for context-aware payload generation and exploitation of services such as AWS Metadata. For blind SSRF, it leverages Out-of-Band (OOB) detection via Webhook.site or custom domains.
2026-04-22 2026Hacking Next.js Targets: Advanced SSRF Exploitation Guide advancedGuide detailing advanced Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications. It covers exploitation techniques targeting the Image component, Next.js Middleware (CVE-2025-57822), and Server Actions (CVE-2024-34351). The guide highlights how misconfigurations in these features can lead to arbitrary outbound requests and potential data leakage or remote code execution. → intigriti.com
2026-04-22 2026Catflix CTF: Exploiting SSRFs in Next.js Middleware intermediateWalkthrough of CVE-2025-57822 in Next.js Middleware, chaining SSRF to RCE via Jenkins. This article details exploiting a misconfiguration in Next.js middleware that allows processing of the `Location` header to perform server-side requests. The SSRF is then escalated by identifying an open Jenkins instance on port 8080, enabling command execution through its Groovy Script console to retrieve sensitive files, demonstrating a practical vulnerability exploitation chain. → intigriti.com
2026-04-22 2026SSRF Guard Bypass via Full-Form IPv4-Mapped IPv6 Literal intermediateLibrary advisory detailing an SSRF protection bypass vulnerability in OpenClaw's `ssrf.ts` component. Versions up to `2026.2.13` are affected by CWE-918, where full-form IPv4-mapped IPv6 literals like `0:0:0:0:0:ffff:7f00:1` bypassed loopback and private network blocking. A fix is available in versions `2026.2.14` and later, addressed by commit `c0c0e0f9aecb913e738742f73e091f2f72d39a19`.
2026-04-22 2026Next.js Improper Middleware Redirect Handling Leads to SSRF (CVE-2025-57822) newsLibrary update addressing CVE-2025-57822 in Next.js Middleware, where improper handling of request headers passed to `NextResponse.next()` could lead to Server-Side Request Forgery (SSRF) in self-hosted applications. Versions v14.2.32 and v15.4.7 resolve this vulnerability by preventing sensitive headers from being reflected back in responses. Users with custom middleware in self-hosted environments should upgrade and verify `next()` function usage.
2026-04-22 2026Craft CMS Cloud Metadata SSRF Protection Bypass via IPv6 Resolution intermediateAdvisory detailing a bypass of Craft CMS's GraphQL SSRF protection. The vulnerability, a bypass of CVE-2025-68437 (GHSA-x27p-wfqw-hfcc), occurs because `gethostbyname()` only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, failing the blocklist comparison. This allows attackers with GraphQL schema permissions to steal AWS credentials by targeting the AWS IMDS IPv6 endpoint via crafted URLs.
2026-04-22 2026Axios Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVE-2026-40175) newsLibrary vulnerability CVE-2026-40175 in Axios allows unrestricted cloud metadata exfiltration via header injection. By leveraging prototype pollution in other dependencies, attackers can trick Axios into sending CRLF-injected headers, enabling request smuggling and bypassing AWS IMDSv2 for credential theft. This critical vulnerability, affecting all versions, arises from a lack of HTTP header sanitization combined with default SSRF capabilities, with potential impacts including authentication bypass and cache poisoning.
2026-04-19 2026CVE-2025-61882 Explained: The Oracle Zero-Day Breach newsAnalysis of CVE-2025-61882, an Oracle EBS zero-day exploited by Cl0p for unauthenticated remote code execution and data theft. The attack chain involves SSRF, CRLF injection, header smuggling, unsafe XSLT processing via BI Publisher, and privilege escalation. This vulnerability, with a CVSS score of 9.8, allowed Cl0p to bypass perimeter controls and exfiltrate sensitive ERP data from numerous enterprises before Oracle released an emergency patch.
2026-04-19 2026Oracle EBS CVE-2025-61882: Pre-auth SSRF Leads to RCE newsWriteup detailing Oracle EBS CVE-2025-61882, a critical pre-authentication RCE vulnerability affecting versions 12.2.3 through 12.2.14. The exploit chain leverages Server-Side Request Forgery (SSRF), CRLF injection, authentication bypass, and unsafe XSLT processing to achieve unauthenticated code execution. The vulnerability, actively exploited by groups like Cl0p, allows attackers to chain SSRF with CRLF injection and path traversal to reach internal services and execute arbitrary code via malicious XSL stylesheets. → picussecurity.com
2026-04-19 2026Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 newsLibrary detailing exploitation of CVE-2025-61882, a critical Oracle E-Business Suite vulnerability, by the Cl0p threat actor for remote code execution. The entry outlines the attack workflow involving XSL payload delivery via a malicious server, Netcat listeners, and specially crafted HTTP requests to `/OA_HTML/SyncServlet` and `/OA_HTML/RF.jsp`. It also highlights a sophisticated chain involving Server-Side Request Forgery (SSRF) and Carriage Return/Line Feed (CRLF) Injection to load untrusted XSLT templates, enabling arbitrary code execution. → thehackernews.com
2026-04-19 2026Oracle E-Business Suite Zero-Day Exploited — Google Cloud newsLibrary of techniques and analysis detailing exploitation of Oracle E-Business Suite (EBS) by the CL0P extortion group. The campaign, which may have leveraged CVE-2025-61882 as a zero-day, involved mass exploitation of vulnerabilities, including Server-Side Request Forgery (SSRF), Carriage-Return Line-Feed (CRLF) injection, authentication bypass, and XSL template injection, leading to remote code execution. The analysis covers intrusion activity preceding the extortion emails, the multi-stage Java implant framework, and provides indicators of compromise for defenders. → cloud.google.com
2026-04-19 2026Server-Side Request Forgery (SSRF) — Practical Guide beginnerServer-Side Request Forgery (SSRF) — Practical Guide
2026-04-18 2026Funny how the more you fuck around the more you find out. Do you see an id? mess around with it can't find the private ip where the http client is running? send a nonexistent host to leak it an enum from there #bugbountytips #SSRF pic.x.com/t0HhOXupGQ intermediateFunny how the more you fuck around, the more you find out. Do you see an id? mess around with it, can't find the private ip where the http client is running? send a nonexistent host to leak it an enum...
2026-04-17 2026Profile picture upload SSRF Port scan Unauthenticated admin panel Mass PII disclosure. The simplest entry points often hide the biggest impact. medium.com/@sagardhoot56/ #bugbounty #hacking #ssrf #ethicalhacking #infosec intermediateProfile picture upload → SSRF → Port scan → Unauthenticated admin panel → Mass PII disclosure. The simplest entry points often hide the biggest impact. medium.com/@sagardhoot56/… #bugbounty #hacking #...
2026-04-17 2026Angular patches a critical 8.7 SSRF flaw in @angular/platform-server. Attackers can hijack SSR origins via URL normalization. Patch v19 v20 or v21 now! #Angular #CyberSecurity #SSRF #WebDev #InfoSec #SSR #VulnerabilityAlert securityonline.info/angular-platfo pic.x.com/8EAUEBNxnf newsAngular patches a critical 8.7 SSRF flaw in @angular/platform-server. Attackers can hijack SSR origins via URL normalization. Patch v19, v20, or v21 now! #Angular #CyberSecurity #SSRF #WebDev #InfoSec...
2026-04-16 2026Bypassing SSRF Filters Using r3dir intermediateTool for bypassing SSRF filters, r3dir, enables attackers to craft malicious requests by controlling redirection targets, response status codes, and HTTP methods. It supports CORS preflight requests for headless browsers and integrates with BurpSuite via Hackvertor tags. The service can bypass weak allowlist filters and URL scheme limitations, and can manipulate HTTP methods from POST to GET using redirect status codes like 301, 302, and 303.
2026-04-16 2026The Limitations of Secure SSRF Patches: Advanced Bypasses advancedLibrary that analyzes Server-Side Request Forgery (SSRF) bypass techniques, demonstrating how common patches like prefix allowlisting and basic hostname validation fail against crafted payloads. It highlights vulnerabilities exemplified by the ChatGPT-Next-Web case, where naive checks for `https://trusted.com` were bypassed using `@` notation or subdomain tricks like `api.mycompany.com.evil.org`. The library emphasizes the need for defense-in-depth beyond superficial checks to prevent attackers from accessing internal networks or cloud instance metadata.
2026-04-16 2026DNS Rebinding Attacks Against SSRF Protections intermediateLibrary for detecting and exploiting DNS rebinding vulnerabilities that bypass SSRF protections. It details how applications resolve hostnames once to validate IPs against blocklists or allowlists, and then resolve again to make the actual HTTP request. This Time-of-Check to Time-of-Use (TOCTOU) flaw allows attackers to control DNS responses, redirecting requests from public IPs to sensitive internal endpoints like AWS IMDS (169.254.169.254) or internal APIs. The library covers techniques and tools like rbndr.us and whonow for setting up controllable DNS servers with zero TTL, and discusses fixes such as resolving once and connecting directly to the IP, using egress proxies like Smokescreen, or implementing network-level controls.
2026-04-16 2026Cloud Metadata Dictionary Useful for SSRF Testing intermediateCloud Metadata Dictionary Useful for SSRF Testing
2026-04-16 2026PayloadsAllTheThings: Server Side Request Forgery beginner Bug BountyLibrary for Server Side Request Forgery (SSRF) vulnerabilities, detailing methodologies and bypass techniques. It covers bypassing localhost via IPv6 notation, domain redirects, CIDR, rare addresses, encoded IPs, and DNS rebinding. The library highlights exploitation via URL schemes like `jar:` and `gopher://`, blind exploitation, and offers tools such as `SSRFmap`, `Gopherus`, `See-SURF`, `SSRF-Sheriff`, `surf`, `ipfuscator`, and `r3dir` for testing and exploitation.
2026-04-16 2026Cloud SSRF Exploitation intermediateCloud SSRF Exploitation
2026-04-16 2026Learning SSRF for Fun and Bounties beginnerLearning SSRF for Fun and Bounties
2026-04-16 2026SSRF Vulnerability on Major Gaming Company (Wiz Bug Bounty) newsWriteup detailing a real-world SSRF vulnerability discovered at a major gaming company. The challenge involves exploiting a content service that fetches resources from provided URLs to access internal cloud infrastructure and sensitive credentials. Attackers aim to trick the server into making unintended requests, thereby reaching hidden internal resources and extracting a flag. → wiz.io
2026-04-16 2026Five Bounties, One Bug: Exploiting the Same SSRF via Five Unique Techniques advancedFive Bounties, One Bug: Exploiting the Same SSRF via Five Unique Techniques
2026-04-16 2026CRITICAL VULNERABILITY (CVSS 10.0) in Axios JS library! CVE-2026-40175 is an SSRF flaw that can lead to RCE and full cloud compromise. PoC is public. If you use Axios update to v1.13.2 NOW! #SupplyChain #RCE #SSRF cyber.netsecops.io/articles/critisvm news🚨 CRITICAL VULNERABILITY (CVSS 10.0) in Axios JS library! CVE-2026-40175 is an SSRF flaw that can lead to RCE and full cloud compromise. PoC is public. If you use Axios, update to v1.13.2 NOW! 🌐 #Supp...
2026-04-15 2026Most hunters skip SSRF because "it's hard to find." That's exactly why it pays. Look for: URL/IP params Webhooks & PDF generators Anything the server fetches The server becomes your proxy. Internal infra = your target. Hunt smarter. #BugBounty #SSRFpic.x.com/W1hHTiDo5CC beginnerMost hunters skip SSRF because "it's hard to find." That's exactly why it pays. Look for: → URL/IP params → Webhooks & PDF generators → Anything the server fetches The server becomes your proxy. Inter...
2026-04-15 2026Inside PostHog: How SSRF a ClickHouse SQL Escaping 0day and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099 ZDI-25-097 ZDI-25-096) #PostHog #RCEChain #SSRF #SQLInjection #Zeroday mehmetince.net/inside-posthog advancedInside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096) #PostHog #RCEChain #SSRF #SQLInjection #Zeroday me...

Frequently Asked Questions

What is SSRF and why is it critical?
Server-Side Request Forgery (SSRF) tricks the server into making HTTP requests to unintended destinations. It is critical because it can access internal services, cloud metadata endpoints (169.254.169.254), and private networks that are not reachable from the internet, potentially leading to full cloud account compromise.
What are common SSRF bypass techniques?
Common bypasses include DNS rebinding, IP encoding tricks (decimal, octal, hex, IPv6), URL parser inconsistencies between the filter and the HTTP library, open redirect chains, and alternative URL schemes. Attackers also use shortened URLs and domain names that resolve to internal IPs.
Where does SSRF commonly appear?
SSRF is frequently found in webhook integrations, URL preview and unfurling features, PDF and screenshot generators, image/file processing pipelines, and any functionality where the application fetches a remote resource based on user-supplied URLs.

Weekly AppSec Digest

Get new resources delivered every Monday.