> For the complete documentation index, see [llms.txt](https://refabr1k.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://refabr1k.gitbook.io/oscp/web/ssrf.md).

# SSRF

### Testing for SSRF vuln

You can get server to request for a url and load resources from it. Eg. If we use the api end point to browse to a webserver, we are able to load it successfully (it is not the same as RFI).

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-LzqRqZdPwVaUt4SaRNp%2F-LzqU3LdeyspLHsDr3Zl%2Fimage.png?alt=media\&token=8cda2de7-27f1-461a-b45f-26bbb80ad242)

To confirm if you have SSRF you should be able to 'query' internal network such as local host ports.

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-LzqRqZdPwVaUt4SaRNp%2F-LzqU56rjPwpfhOgw4TV%2Fimage.png?alt=media\&token=7e568eb9-226c-4995-a519-64b8b03c987f)

### SSRF scanning local ports

(use --hl=2 to hide Lines that return 2 only.. This is if there are too many false positives) 

`wfuzz -c -z range,1-65535 --hl=2` [`http://10.10.10.55:60000/url.php?path=127.0.0.1:FUZZ`](http://10.10.10.55:60000/url.php?path=127.0.0.1:FUZZ)

![](https://2057628634-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzoLyb83qrgLVzBgfMJ%2F-LzqRqZdPwVaUt4SaRNp%2F-LzqU6dbbboIQojGj_q0%2Fimage.png?alt=media\&token=68ed31f7-5cf6-405e-b47a-3d899be13493)

We are able to query internal ports 22, 90,110,200,320,888 To view these resources simply browse to them.