Penetration testers and security researchers
During a web application penetration test to identify SSRF vulnerabilities in URL parameters like ?url= or ?link=.
사용 사례
소개
The SSRF Search & Destroy mind map template provides a comprehensive breakdown of Server-Side Request Forgery (SSRF) vulnerabilities, covering over 100 attack vectors, bypass techniques, and mitigation strategies. It includes detailed branches on DNS rebinding, URL parser logic, cloud metadata APIs (AWS, GCP, Azure), and file read exploits such as /proc/self/environ and C:/Windows/win.ini. This SSRF cheat sheet is an essential resource for penetration testers, security engineers, and bug bounty hunters looking to identify and exploit SSRF flaws in web applications. The template is organized into 18 major branches, including Attacks, Bypass block list, Redirect, and Schemas, with specific nodes like 'Localhost Representation' covering http://0/, http://127.1, and http://0.0.0.0.
이용약관이 템플릿을 사용할 때
Application security engineers and developers
When reviewing code for SSRF-prone features such as file uploads by URL, URL previews, or image rendering.
Bug bounty hunters and red teamers
While preparing for a bug bounty program to test for SSRF in cloud environments and internal network recon.
이 템플릿 사용 방법
단계 1
Open and Explore Attack Vectors
Open the .xmind file to navigate through the 18 major branches including DNS rebinding, cloud metadata APIs, and URL parser logic.
단계 2
Identify Parameters and Test Payloads
Utilize the 'Where to find' and 'Bypass block list' branches to locate vulnerable parameters and apply specific payloads like localhost representations.
단계 3
Customize and Export Security Findings
Add your own research notes or test results directly to the nodes before exporting the map as an image or PDF for your final report.
자주 묻는 질문
The template includes 18 major branches covering SSRF attacks, DNS rebinding, bypass techniques, cloud metadata APIs, file read exploits, and more. It contains over 100 nodes with specific payloads and techniques.
Open the .xmind file in Xmind, then navigate through branches like 'Attacks' and 'Bypass block list' to find payloads. Use the 'Where to find?' section to identify SSRF-prone parameters like ?url=, ?uri=, and ?link=.
Yes, the template is free to download and fully editable in Xmind. You can add your own notes, payloads, or reorganize branches to suit your workflow.
The template covers address encoding (octal, decimal, hex), Unicode normalization, URL parser logic, IPv6 representations, and localhost aliases like http://0/ and http://127.1.
The 'Cloud meta API' branch provides AWS metadata endpoints (e.g., 169.254.169.254/latest/user-data) and tips to identify cloud providers. Use redirects or DNS rebinding to access internal metadata.
공유하고 싶은 템플릿이 있나요?
전 세계 크리에이터와 마인드맵 템플릿을 공유하고 작품으로 수익을 창출하세요.
무료 템플릿