Browse / Server-Side Request Forgery

Server-Side Request Forgery

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Server-Side Request Forgery (SSRF)329

Often found together with

• Information Disclosure53
• Code Execution38

Most upvoted Server-Side Request Forgery reports

AllValidInformativeN/ADuplicate

1. Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal portsInformativeServer-Side Request Forgery (SSRF) · Mozilla
   53 votes
2. DNS Rebinding AttackInformativeServer-Side Request Forgery (SSRF) · critical · arkadiyt-projects
   42 votes
3. Unauthenticated SSRF via Public Reference API -Sharing Token BypassInformativeServer-Side Request Forgery (SSRF) · Nextcloud
   41 votes
4. [nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowedInformativeServer-Side Request Forgery (SSRF) · medium · Nextcloud
   25 votes
5. Server side request forgery (SSRF) on nextcloud implementation.InformativeServer-Side Request Forgery (SSRF) · Nextcloud
   19 votes
6. 50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usableInformativeServer-Side Request Forgery (SSRF) · curl
   13 votes
7. curl-ipv4-percent-normalization-SSRFInformativeServer-Side Request Forgery (SSRF) · medium · curl
   13 votes
8. IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different hostInformativeServer-Side Request Forgery (SSRF) · high · curl
   12 votes
9. GET /api/v2/url_info endpoint is vulnerable to Blind SSRFInformativeServer-Side Request Forgery (SSRF) · high · Automattic
   9 votes
10. Blind SSRF at https://chat.makerdao.com/account/profileInformativeServer-Side Request Forgery (SSRF) · critical · BlockDev Sp. Z o.o
    7 votes
11. Information disclosure through Server side resource forgeryInformativeServer-Side Request Forgery (SSRF) · medium · Stripo Inc
    7 votes
12. SSRF via maliciously crafted URL due to host confusionInformativeServer-Side Request Forgery (SSRF) · critical · curl
    6 votes
13. SSRF at apps.nextcloud.com/developer/apps/releases/newInformativeServer-Side Request Forgery (SSRF) · Nextcloud
    4 votes
14. Abusing URL Parsers by long schema nameInformativeServer-Side Request Forgery (SSRF) · curl
    3 votes
15. SSRF in rompager-checkInformativeServer-Side Request Forgery (SSRF) · low · Hanno's projects
    3 votes
16. Possible SSRF in email server settings(SMTP mode)InformativeServer-Side Request Forgery (SSRF) · medium · Nextcloud
    2 votes