The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | Blind SSRF with Burp Collaborator intermediate | Blind SSRF with Burp Collaborator |
| 2026-04-10 2026 | Blind SSRF with Shellshock Exploitation intermediate | Blind SSRF with Shellshock Exploitation |
| 2026-04-10 2026 | Testing for Blind SSRF with Burp Suite intermediate 1 min read | Tutorial on detecting blind SSRF vulnerabilities using Burp Suite's Collaborator. This method involves injecting a Collaborator payload into an HTTP request, often within parameters like `productId` or headers like `Referer`, and then monitoring the Collaborator tab for out-of-band interactions from the target application. The presence of these interactions confirms the application's susceptibility to blind SSRF. → portswigger.net |
| 2026-04-10 2026 | Blind SSRF Lab: Out-of-Band Detection intermediate | Library for demonstrating blind SSRF, specifically focusing on out-of-band detection via DNS and HTTP interactions. It guides users to intercept requests in Burp Suite, insert a Collaborator Payload into the Referer header, and analyze the resulting interactions in the Collaborator tab to confirm server-side command execution initiated by the application. → portswigger.net |
| 2026-04-10 2026 | Blind SSRF Vulnerabilities - PortSwigger beginner 2 min read | Reference on blind SSRF vulnerabilities, detailing how these occur when applications make back-end HTTP requests to supplied URLs without returning responses. It explains that while less impactful than informed SSRF, blind SSRF can still lead to remote code execution. The document highlights out-of-band (OAST) techniques, particularly using Burp Collaborator, as the most reliable detection method, and discusses exploitation strategies like sweeping internal IP space or inducing malicious responses by controlling external systems. → portswigger.net |
| 2026-04-10 2026 | Uncovering Blind SSRF Using Burp Collaborator intermediate | Uncovering Blind SSRF Using Burp Collaborator |
| 2026-04-10 2026 | How SSRF Leads to RCE in a .NET Application advanced | How SSRF Leads to RCE in a .NET Application |
| 2026-04-10 2026 | From SSRF to RCE: A 7-Step Chain Against PostHog advanced | From SSRF to RCE: A 7-Step Chain Against PostHog → infosecwriteups.com |
| 2026-04-10 2026 | MCPwnfluence: SSRF to RCE in Atlassian MCP Server (Pluto Security) advanced 10 min read | Library for securing Atlassian MCP Server, addressing vulnerabilities CVE-2026-27825 (arbitrary file write leading to RCE) and CVE-2026-27826 (SSRF via header injection). These flaws allow unauthenticated users on the local network to execute commands as root by chaining an SSRF vulnerability with an arbitrary file write, enabling overwriting critical files like `.bashrc` or `.ssh/authorized_keys`. The library includes fixes for path validation and SSRF protection, recommending immediate upgrades for affected versions below 0.17.0. |
| 2026-04-10 2026 | Blind SSRF to RCE Vulnerability Exploitation intermediate 3 min read | Writeup demonstrating blind SSRF to RCE exploitation, detailing how an attacker can leverage a blind Server-Side Request Forgery vulnerability. This technique involves port scanning using the Gopher protocol to identify open services like Redis (TCP 6379) and then employing the Gopherus tool to generate payloads. These payloads can target various services such as MySQL, FastCGI, Memcached, Redis, Zabbix, and SMTP, ultimately allowing for the planting of a reverse shell and achieving Remote Code Execution. → resecurity.com |
| 2026-04-10 2026 | SSRF: From Ping to RCE intermediate | SSRF: From Ping to RCE |
| 2026-04-10 2026 | MCPwnfluence: Critical SSRF to RCE in mcp-atlassian (Pluto Security) advanced 10 min read | Writeup of CVE-2026-27825 and CVE-2026-27826, detailing an unauthenticated SSRF to RCE attack chain in mcp-atlassian. The vulnerabilities, with CVSS scores of 9.1 and 8.2 respectively, allow network-reachable code execution as root by overwriting files or injecting SSRF payloads via Atlassian URL headers. Affecting versions prior to 0.17.0, the findings highlight risks in widely used MCP server deployments. |
| 2026-04-10 2026 | MindsDB: Bypass SSRF Protection with DNS Rebinding intermediate 2 min read | Writeup detailing how DNS rebinding can bypass SSRF protection in MindsDB. This technique manipulates domain name resolution, allowing an initial DNS query to a public IP address followed by a subsequent request to a private IP. The writeup includes a Python Proof of Concept utilizing Flask and demonstrating how to exploit this vulnerability, leading to potential Server-Side Request Forgery and Denial of Service impacts. |
| 2026-04-10 2026 | CVE-2026-27127: Weaponizing DNS Rebinding to Bypass SSRF Filters in Craft CMS intermediate 4 min read | Writeup on CVE-2026-27127 details a critical SSRF bypass in Craft CMS. Attackers leverage DNS rebinding, exploiting a TOCTOU race condition within the GraphQL Asset mutation logic. This technique circumvents IP blocklists by dynamically changing DNS records between validation and connection phases, allowing them to steal cloud metadata credentials by tricking the application into connecting to internal endpoints like 169.254.169.254. The fix shifts validation to the HTTP client's connection phase using Guzzle's ON_STATS option. |
| 2026-04-10 2026 | Bypassing SSRF Protection in nossrf: When Safeguards Become Loopholes intermediate 3 min read | Writeup on bypassing SSRF protection in the `nossrf` npm package, affecting all versions up to and including 1.0.3. The vulnerability stems from the package's validation logic, which uses Google DNS to resolve hostnames but fails to check if the resolved IP address belongs to a local or reserved IP space. Attackers can craft hostnames that resolve to local IPs, such as 127.0.0.1, bypassing the protection and enabling potential SSRF attacks. |
| 2026-04-10 2026 | Using DNS To Bypass SSRF Protections intermediate 2 min read | Library for bypassing SSRF denylist protections by using DNS to resolve an external domain name to a target IP address, specifically demonstrating this technique against Azure metadata API (169.254.169.254) by configuring a subdomain to point to the metadata IP. This method effectively circumvents common deny-list controls found in web application penetration tests. |
| 2026-04-10 2026 | CVE-2026-27127: Craft CMS Cloud Metadata SSRF via DNS Rebinding intermediate | CVE-2026-27127: Craft CMS Cloud Metadata SSRF via DNS Rebinding → advisories.gitlab.com |
| 2026-04-10 2026 | HackerOne: SSRF Mitigation Bypass Using DNS Rebind Attack intermediate | HackerOne: SSRF Mitigation Bypass Using DNS Rebind Attack → hackerone.com |
| 2026-04-10 2026 | SSRF with DNS Rebinding - Clear Gate intermediate | SSRF with DNS Rebinding - Clear Gate |
| 2026-04-10 2026 | Bypass SSRF with DNS Rebinding intermediate | Bypass SSRF with DNS Rebinding |
| 2026-04-10 2026 | Meta Bug Bounty: SSRF Payout Guidelines news | Guidelines for assessing Server Side Request Forgery (SSRF) vulnerabilities, with a maximum payout cap of $40,000. These guidelines detail impact assessment and potential deductions. Meta provides a canary endpoint, `https://www.internalfb.com/intern/bug-bounty/get-canary-token/`, for researchers to test SSRF findings and retrieve a canary token if data is successfully read. A bonus may apply for demonstrating full control of HTTP requests, while deductions can occur for rate-limited or delayed requests. |
| 2026-04-10 2026 | HackerOne: SSRF in Search.gov via URL Parameter news | HackerOne: SSRF in Search.gov via URL Parameter → hackerone.com |
| 2026-04-10 2026 | SSRF Worth $4,913: My Highest Bounty Ever news | SSRF Worth $4,913: My Highest Bounty Ever |
| 2026-04-10 2026 | Bug Bounty Write-up: From SSRF to $4000 news 5 min read | Writeup of a bug bounty discovery detailing the exploitation of a Server-Side Request Forgery (SSRF) vulnerability, escalating it to Remote Code Execution (RCE) through command injection. The process involves leveraging the SSRF to exfiltrate internal files like `/etc/passwd` and write to server files, culminating in the addition of an SSH public key to gain unauthorized access to the vulnerable server. |
| 2026-04-10 2026 | HackerOne: SSRF via Analytics Reports news | HackerOne: SSRF via Analytics Reports → hackerone.com |
| 2026-04-10 2026 | Exploit SSRF to Gain AWS Credentials intermediate 6 min read | Writeup detailing how to exploit Server-Side Request Forgery (SSRF) vulnerabilities in AWS EC2 instances to gain AWS credentials. It demonstrates how an SSRF flaw, combined with the default Instance Metadata Service (IMDS) v1 configuration, allows attackers to retrieve sensitive information, including IAM role credentials. The article covers vulnerable code examples, exploitation techniques using IMDS v1 endpoints, and remediation strategies such as enforcing IMDSv2, implementing Web Application Firewalls (WAFs), and proper input validation in application code. |
| 2026-04-10 2026 | Hackers Exploit SSRF in EC2 to Steal AWS Credentials news 5 min read | Library detailing Server-Side Request Forgery (SSRF) exploits against AWS EC2 instances, specifically targeting the EC2 metadata URL (http://169.254.169.254/latest/meta-data/) to steal AWS IAM credentials via IMDSv1. The campaign, observed between March 13-25, 2025, by F5 Labs, involved rotating query parameter names and subpaths to evade detection. Mitigation strategies include upgrading to IMDSv2, auditing EC2 permissions, implementing SSRF filters, and utilizing tools like AWS GuardDuty. |
| 2026-04-10 2026 | SSRF Explained: Attack Techniques and Real-World Exploits beginner 7 min read | Library detailing Server-Side Request Forgery (SSRF) attack techniques, including exploiting cloud metadata endpoints on AWS, GCP, and Azure, bypassing blocklists with alternative IP representations and DNS rebinding, abusing URL schemes like `file://`, `dict://`, and `gopher://`, chaining open redirects, and accessing internal services like Kubernetes APIs and admin panels. It also covers blind SSRF, out-of-band detection, and exploitation via server-side PDF generation using `wkhtmltopdf`. |
| 2026-04-10 2026 | Campaign Targets Amazon EC2 Instance Metadata via SSRF intermediate 6 min read | Analysis of March 2025 threats details a campaign exploiting Amazon EC2 Instance Metadata via Server-Side Request Forgery (SSRF), exposing sensitive data including IAM role credentials. This campaign, unrelated to a specific CVE, leverages CWE-200 and CWE-918. The analysis also highlights continued exploitation of CVE-2017-9841 (PHPUnit RCE), CVE-2023-1389 (TP-Link RCE), CVE-2024-4577 (PHP-CGI argument injection), and CVE-2019-9082 (ThinkPHP RCE). |
| 2026-04-10 2026 | Steal EC2 Metadata Credentials via SSRF intermediate 2 min read | Writeup detailing how Server Side Request Forgery (SSRF) or XML External Entity (XXE) vulnerabilities on an EC2 instance can be exploited to steal IAM credentials from the Instance Metadata Service (IMDS). This technique allows attackers to access sensitive information, including credentials associated with IAM roles, by making requests to the `169.254.169.254` IP address. The article highlights the importance of enforcing IMDSv2 to mitigate this common AWS attack vector. |
| 2026-04-10 2026 | SSRF in Cloud Environments: Exploiting AWS Metadata Services intermediate | SSRF in Cloud Environments: Exploiting AWS Metadata Services |
| 2026-04-10 2026 | SSRF to AWS Metadata Exposure: How Attackers Steal Cloud Credentials intermediate 6 min read | Writeup on Server-Side Request Forgery (SSRF) to AWS metadata exposure, detailing how attackers exploit unvalidated user input to access the EC2 Instance Metadata Service (IMDS) at 169.254.169.254. The article demonstrates the technique of traversing the metadata hierarchy to extract temporary IAM role credentials, leading to potential cloud credential theft, internal network scanning, and unauthorized access to AWS services. Mitigation strategies include enabling IMDSv2, enforcing strict URL validation, and restricting network access. → resecurity.com |
| 2026-04-10 2026 | CVE-2026-34981: SSRF in whisperX-FastAPI news 3 min read | Writeup of CVE-2026-34981, a Server-Side Request Forgery (SSRF) vulnerability in whisperX-FastAPI. Versions 0.3.1 through 0.5.x are affected in `FileService.download_from_url()` due to unvalidated URL inputs, allowing attackers to append `.mp3` to internal URLs to bypass extension checks. The unauthenticated `/speech-to-text-url` endpoint facilitates exploitation, potentially leading to unauthorized information disclosure. The vulnerability is fixed in version 0.6.0. → radar.offseq.com |
| 2026-04-09 2026 | Grafana CVE-2025-4123: Full Read SSRF & Account Takeover news | Grafana CVE-2025-4123: Full Read SSRF & Account Takeover |
| 2026-04-09 2026 | Securing Agentic AI & MCP from SSRF and Injection intermediate | Securing Agentic AI & MCP from SSRF and Injection |
| 2026-04-09 2026 | Blind SSRF into Internal Port Scanning intermediate | Blind SSRF into Internal Port Scanning |
| 2026-04-09 2026 | From SSRF to Port Scanner intermediate 3 min read | Technique demonstrating SSRF exploitation for internal and external port scanning, bypassing firewalls. This method leverages the web server's response to differentiate open from closed ports, utilizing Burp Intruder for efficient port enumeration, and discusses mitigation strategies like whitelisting DNS names, proper response handling, and request rate limiting. → cobalt.io |
| 2026-04-09 2026 | Spring Cloud Config SSRF via Profile Substitution (CVE-2026-22739) news | Library for securing Spring Cloud Config, addressing CVE-2026-22739. This vulnerability allows Server-Side Request Forgery (SSRF) when the profile parameter is substituted in requests to a native file system backend, enabling access to files outside search directories, or when using a source control backend, allowing substitution into repository URLs. Users should upgrade to the fixed version. |
| 2026-04-09 2026 | Exploitation of an SSRF Vulnerability Against EC2 IMDSv2 intermediate 4 min read | Writeup details the exploitation of an SSRF vulnerability against Atlassian Confluence instances on AWS, specifically targeting EC2 IMDSv2. The process involves bypassing IMDSv2's authentication by leveraging the `gadgets.io.makeRequest()` function's ability to control HTTP methods and headers. This allows attackers to obtain an IMDSv2 session token, which is then used to exfiltrate sensitive metadata, including hardcoded credentials for PostgreSQL, Tenable Nessus, and Hibernate, as well as EC2 instance security credentials. |
| 2026-04-09 2026 | How SSRF Exploits IMDSv2 Limitations in AWS intermediate | How SSRF Exploits IMDSv2 Limitations in AWS |
| 2026-04-09 2026 | FastMCP SSRF & Path Traversal via OpenAPI Provider (CVE-2026-32871) news | FastMCP SSRF & Path Traversal via OpenAPI Provider (CVE-2026-32871) → advisories.gitlab.com |
| 2026-04-09 2026 | Docker Model Runner SSRF in OCI Registry (CVE-2026-33990) news | Docker Model Runner SSRF in OCI Registry (CVE-2026-33990) → advisories.gitlab.com |
| 2026-04-09 2026 | AVideo SSRF Protection Bypass via Extension Allowlist (CVE-2026-39370) news | AVideo SSRF Protection Bypass via Extension Allowlist (CVE-2026-39370) → advisories.gitlab.com |
| 2026-04-09 2026 | AVideo Stored SSRF via Live Restream Log Callback (CVE-2026-39368) news | AVideo Stored SSRF via Live Restream Log Callback (CVE-2026-39368) → advisories.gitlab.com |
| 2026-04-09 2026 | mcp-from-openapi SSRF via $ref Dereferencing (CVE-2026-39885) news | mcp-from-openapi SSRF via $ref Dereferencing (CVE-2026-39885) → advisories.gitlab.com |
| 2026-04-09 2026 | Directus SSRF Bypass via IPv4-Mapped IPv6 Addresses (CVE-2026-35409) intermediate | Directus SSRF Bypass via IPv4-Mapped IPv6 Addresses (CVE-2026-35409) → advisories.gitlab.com |
| 2026-04-09 2026 | Payload CMS Authenticated SSRF via Upload (CVE-2026-34746) news | Payload CMS Authenticated SSRF via Upload (CVE-2026-34746) → advisories.gitlab.com |
| 2026-04-09 2026 | Server-Side Request Forgery (SSRF) Complete Guide (2026) beginner | Server-Side Request Forgery (SSRF) Complete Guide (2026) |
| 2026-04-09 2026 | Auditing and Mitigating Axios SSRF in Kubernetes (CVE-2025-27152) intermediate 4 min read | Library for auditing and mitigating CVE-2025-27152, a Server-Side Request Forgery vulnerability in Axios that can lead to credential leakage via redirects. This resource details how to identify vulnerable Axios versions within Kubernetes clusters, outlines an attack scenario involving crafted redirects, and presents Kubernetes NetworkPolicies as a hardening strategy to block unwanted outbound traffic, supplementing dependency upgrades. It emphasizes a layered defense approach including dependency tracking and network isolation. |
| 2026-04-09 2026 | Advanced Techniques for Exploiting SSRF Vulnerabilities advanced | Advanced Techniques for Exploiting SSRF Vulnerabilities |