[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572232-105":53,"doc-detail-572232-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","ssrf-bible-cheat-sheet-security-testing-and-exploitation","SSRF Bible - Cheat Sheet - Security Testing and Exploitation","","SSRF Bible cheat sheet compiles options, examples, and exploitation techniques for Server Side Request Forgery attacks, focusing on how vulnerable servers generate outbound requests across internal and internet services. It outlines typical attack steps such as scanning internal networks, enumerating opened ports, fingerprinting services, identifying SSRF combinations, and finding host-based auth opportunities. The guide details file descriptor exploitation via interpreters, exec-based FD access, and ProcFS limits, then summarizes supported URL schemes and protocol smuggling across common HTTP parsers.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/ssrf-bible-cheat-sheet-security-testing-and-exploitation/572232/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/ssrf-bible-cheat-sheet-security-testing-and-exploitation/572232.png","ImageObject",442,249,{"name":88,"@type":89},"Aran","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-23","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is SSRF and what does this cheat sheet collect?","Question",{"text":108,"@type":109},"SSRF (Server Side Request Forgery) enables a vulnerable server to create requests to internal or internet services. The cheat sheet collects interaction options and examples of such communication, including attack steps and exploitation patterns.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What are the typical steps used to perform an SSRF attack in this guide?",{"text":113,"@type":109},"The guide lists scanning internal networks, collecting opened ports (often via timing), determining services on those ports, classifying the SSRF combination, and then probing for smuggling and host-based auth exploitation opportunities.",{"name":115,"@type":106,"acceptedAnswer":116},"How does the document discuss file descriptor exploitation in SSRF contexts?",{"text":117,"@type":109},"It describes three approaches: interpreter/API-based wrappers (e.g., fd://), exec-call methods to access file descriptors, and ProcFS paths like /proc/\u003CPID>/fd/\u003CN>, with a specific note that sockets cannot be accessed through ProcFS file descriptors.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572232,1792208338,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},137455076865,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","SSRF bible. Cheat sheet  \nRevision 1.03  \n26 Jan 2017  \nAuthors:  \n@Wallarm @d0znpp  \nresearch team  \n[Wallarm.com](Wallarm.com|lab.wallarm.com)[|](Wallarm.com|lab.wallarm.com)[lab.wallarm.com](Wallarm.com|lab.wallarm.com)  \nTry our new product. Wallarm FAST: security tests from traffic  \n[https://wallarm.com/wallarm-fast/](https://wallarm.com/wallarm-fast/)  \n[wallarm.com](wallarm.com) 1  \nTable of contents  \nTable of contents Basics  \nTypical attack steps  \nFile Descriptors exploitation way URL schema support  \nProtocols SSRF smuggling Smuggling examples  \nApache web-server [HTTP](HTTP) parser  \nNginx web-server [HTTP](HTTP) parser  \nVulnerabilities Basics Examples  \nGoogle Docs  \nZeroNights hackquest challenge  \nExploitation tricks Bypassing restrictions  \nInput validation  \nUnsafe redirect  \nDNS pinning  \nDNS pinning race condition  \nPHP fsockopen() url parsing tricks  \nNetwork restrictions Protocol fingerprinting  \nExamples  \n[HTTP](HTTP)  \nMemcached Retrieving data  \nExamples  \n[HTTP](HTTP) response encapsulation into XML formatted response  \nConsole cURL wildcards URL responses concatenation SMBRelay exploitation  \nOriginal request data sniffing  \nExamples Memcached  \n[wallarm.com](wallarm.com) 2  \nExploits PHP-FPMSyslog  \nExploits Zabbix agentd  \nExploits Postgres  \nExploits MongoDBRedis Couch DB  \nExploits FFmpeg  \nReferences Tools Researches  \n[wallarm.com](wallarm.com) 3  \nBasics  \nSSRF - Server Side Request Forgery attacks. The ability to create requests from the vulnerable server to intra/internet. Using a protocol supported by available URI schemas, you can communicate with services running on other protocols. Here we collect the various options and examples (exploits) of such interaction. See for introduction related researches.  \nTypical attack steps  \n1. Scan internal network to determine internal infrastructure which you may access  \n2. Collect opened ports at localhost and other internal hosts which you want (basically by time-based determination)  \n3. Determine services/daemons on ports using wiki or daemons banners (if you may watch output)  \n4. Determine type of you SSRF combination:  \n○ Direct socket access (such as this example)  \n○ Sockets client (such as java URI, cURL, LWP, others)  \n5. In case of direct socket access determine CRLF and other injections for smuggling  \n6. In case of sockets client, determine available URI schemas  \n7. Compare available schemas and services/daemons protocols to find smuggling possibilities  \n8. Determine host-based auth daemons and try to exploit it  \nFile Descriptors exploitation way  \nUseful in clouds, shared hostings and others large infrastructures. First read slides 20-21 about FDs and 22-23 about ProcFS from this paper.  \nThere are three ways to access to FDs:  \n● Interpreters API (such as fd:// wrapper for PHP)  \n○ If there are no such API or required functions disabled, you can try to load native extension:  \n■ PHP (require dlopen, but not exec): [https://github.com/dhotson/fdopen-php](https://github.com/dhotson/fdopen-php)  \n● exec() call from API (such as exec(‘echo 123 > &\u003CFDN>’);)  \n○ you may access only FDs without O CLOEXEC flag.  \n○ C program to scan available FDs is here: [https://github.com/ONsec-Lab/scripts/blob/master/list-open-fd.c](https://github.com/ONsec-Lab/scripts/blob/master/list-open-fd.c).  \n● ProcFS files (/proc/\u003CPID>/fd/\u003CN>)  \n* Note, that you can not access to sockets through /proc/\u003CPID>/fd/\u003CN> files!  \n[wallarm.com](wallarm.com) 4  \nURL schema support  \n\n|  | PHP | Java | cURL | LWP | ASP. NET1 |\n| --- | --- | --- | --- | --- | --- |\n| gopher | enable by\u003Cbr>--with-curlwrappers | before last patches | w/o \\0 char | + | ASP. NET \u003C=3 and Windows XP and Windows Server 2003 R2 and earlier only |\n| tftp | enable by\u003Cbr>--with-curlwrappers | - | w/o \\0 char | - | - |\n| [http](http) | + | + | + | + | + |\n| [https](https) | + | + | + | + | + |\n| ldap | - | - | + | + | - |\n| ftp | + | + | + | + | + |\n| dict | enable by\u003Cbr>--with-curlwrappers | - |","cbCaibDxJKOHKkfP","https://ap.wps.com/l/cbCaibDxJKOHKkfP","pdf",198059,23,"English","# Basics\n## Typical attack steps\n## File Descriptors exploitation way\n## URL schema support\n## Protocols SSRF smuggling\n## Smuggling examples\n# Vulnerabilities and Examples\n## Google Docs\n## ZeroNights hackquest challenge\n## Exploits and references","[{\"question\":\"What is SSRF and what does this cheat sheet collect?\",\"answer\":\"SSRF (Server Side Request Forgery) enables a vulnerable server to create requests to internal or internet services. The cheat sheet collects interaction options and examples of such communication, including attack steps and exploitation patterns.\"},{\"question\":\"What are the typical steps used to perform an SSRF attack in this guide?\",\"answer\":\"The guide lists scanning internal networks, collecting opened ports (often via timing), determining services on those ports, classifying the SSRF combination, and then probing for smuggling and host-based auth exploitation opportunities.\"},{\"question\":\"How does the document discuss file descriptor exploitation in SSRF contexts?\",\"answer\":\"It describes three approaches: interpreter/API-based wrappers (e.g., fd://), exec-call methods to access file descriptors, and ProcFS paths like /proc/\\u003cPID\\u003e/fd/\\u003cN\\u003e, with a specific note that sockets cannot be accessed through ProcFS file descriptors.\"}]","SSRF Bible - Cheat Sheet - Security Testing and Exploitation | PDF",1791926283,8]