Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
SSRF
Forcing the server to perform requests on your behalf — reaching internal services, cloud metadata, or localhost ports that were never meant to face a user. The server's network position is the prize: things unreachable from the internet are one SSRF away.
Severity guide
Critical when it reaches cloud metadata (credentials) or internal admin panels; medium when it only confirms internal port access; map each response difference to what it proves.
Where to look
entry points to test first01
URL-import features
Avatar-from-URL, webhook configuration, 'import from link', RSS/HTML importers — the server fetches what you provide.
02
Document generators
PDF/HTML-to-PDF renderers, screenshot services, image resizers — they fetch remote resources while rendering.
03
File & data sync
CMS plugins, backup/restore from URL, cloud-storage bridges — long-running fetchers that rarely validate targets.
04
Anything with an allow-list
A feature that restricts domains is already thinking about SSRF — finding the flaw in the validator is the bug.
05
Blind channels
Email verifications, DNS prefetch, monitoring pings — no response needed if an out-of-band callback proves the fetch.
How to hunt it
in order, start to finishFind features that fetch URLs
Webhooks, PDF/image generators, importers, avatar-from-URL, link previews — anywhere the server requests a resource you influence.
Point it at itself
Swap in 127.0.0.1 and localhost with common ports (80, 443, 8080, 3000, 5000). A response that differs from an external fetch — content, timing, error type — proves internal access.
Hit the cloud metadata
On AWS/GCP/Azure infrastructure, 169.254.169.254 serves instance credentials (AWS needs IMDSv2 headers on modern hosts). This single finding is usually critical.
Bypass allow-lists
Try 0.0.0.0, IPv6 [::], decimal/octal IP forms, DNS names that resolve internally, or a domain you control that 302-redirects to the internal target — redirect-following is the classic validator bypass.
Escalate what you can reach
Internal admin panels, unauthenticated services (Redis, Elasticsearch, Actuator endpoints), or metadata credentials turn SSRF into RCE or full account takeover.
Filter & validation bypasses
when your first tries get blocked- 01Host allow-listed? Your own domain → 302 → internal target (redirect following beats validation).
- 02IP filtered? 0.0.0.0, [::], 2130706433 (decimal), 0x7f000001 (hex), or DNS rebinding resolve to the same place.
- 03Scheme restricted to http? Some clients honor gopher:// and file:// — read local files through the URL fetcher.
- 04Response blocked? Use blind channels — DNS callbacks, response-time differences, or error-message contents.
Impact ladder
what makes it payable- 01Cloud credential theft — metadata service tokens become account access.
- 02Internal service access — admin panels, databases, message queues behind the firewall.
- 03Port scanning of the internal network — mapped infrastructure for follow-up bugs.
- 04Chained RCE — metadata → temp credentials → instance takeover.
Payloads
6 · from PayloadsAllTheThingshttp://169.254.169.254/latest/meta-data/AWS metadata — instance role credentials on the same host.
http://127.0.0.1:80Loopback probe — a different response proves internal access.
http://localhost:22Port-scan via error/timing differences.
http://0.0.0.0:800.0.0.0 often slips past naive localhost blocklists.
http://[::]:80/IPv6 loopback form — filters that only check 127.0.0.1 miss it.
https://localhost:443HTTPS variant for TLS-only internal services.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.