SSRF Filter Bypass With Encodings and Redirect Chains
An SSRF filter often checks the URL once while the HTTP client interprets it later. If those two components disagree about the host—or the client follows a redirect without rechecking—the allowlist is decoration.
Start with a callback domain you control. Confirm the server makes a request, identify its DNS resolver and user agent, then test parser behavior. Jumping straight to cloud metadata is noisy and may violate policy.
Encodings worth testing deliberately
IPv4 has more spellings than 127.0.0.1. Depending on the runtime, these may resolve to loopback:
- Integer form:
2130706433 - Hex:
0x7f000001 - Octal-looking segments:
0177.0.0.1 - Short form:
127.1 - IPv4 embedded in IPv6:
[::ffff:127.0.0.1]
Do not spray the list blindly. Send each to your own listener first and observe what host the application requested. Libraries have tightened parsing over time, so a payload that worked in an old Node release may be rejected today.
URL confusion adds another layer. Userinfo syntax (trusted.example@127.0.0.1), fragments, backslashes, encoded delimiters, trailing dots, and mixed-case hostnames can split a validation parser from a fetch parser. Double encoding only matters when two decoding passes actually occur. Capture evidence for the transformation instead of pasting a giant payload list into the report.
The redirect test that catches real systems
Host a URL on an allowed or attacker-controlled domain:
https://listener.example/start
Return a 302 Location: http://127.0.0.1:PORT/canary. If the server follows it, the destination must be validated again after every hop. Some defenses approve the first hostname and let the HTTP client chase five redirects anywhere.
You can prove the bypass without reading internal secrets. Redirect to a private address and compare timing or a harmless known endpoint, or use a DNS setup that records resolution behavior. If the program supplies a test metadata service, use that. Otherwise ask before touching 169.254.169.254.
DNS rebinding tests belong later. A hostname may resolve publicly during validation and privately during connection. Reliable defenses pin resolved addresses, reject private/reserved ranges after DNS resolution, and repeat the check on redirects. They also handle every A and AAAA answer, not just the first.
Separate access from impact
An outbound hit to your Collaborator proves server-side fetching. Reaching localhost proves network-boundary bypass. Reading an unauthenticated admin endpoint or cloud credential endpoint raises severity again. Keep those claims separate so the report survives scrutiny.
Record the submitted URL, each redirect response, DNS answers, final destination, and returned application response. Redact tokens. One clean chain beats 40 encoded variants with no explanation.
PortSwigger's SSRF guide covers blacklist bypasses and open-redirection chains. OWASP's SSRF Prevention Cheat Sheet recommends canonicalization, strict allowlists, and network controls. Use CWE-918 in the report. The practical fix is to parse once with a trusted library, resolve and validate every destination address, and disable redirects unless the feature truly needs them.