Penetration testers and security researchers
During a web application penetration test to identify SSRF vulnerabilities in URL parameters like ?url= or ?link=.
分類
關於
The SSRF Search & Destroy mind map template provides a comprehensive breakdown of Server-Side Request Forgery (SSRF) vulnerabilities, covering over 100 attack vectors, bypass techniques, and mitigation strategies. It includes detailed branches on DNS rebinding, URL parser logic, cloud metadata APIs (AWS, GCP, Azure), and file read exploits such as /proc/self/environ and C:/Windows/win.ini. This SSRF cheat sheet is an essential resource for penetration testers, security engineers, and bug bounty hunters looking to identify and exploit SSRF flaws in web applications. The template is organized into 18 major branches, including Attacks, Bypass block list, Redirect, and Schemas, with specific nodes like 'Localhost Representation' covering http://0/, http://127.1, and http://0.0.0.0.
使用條款何時使用此範本
Application security engineers and developers
When reviewing code for SSRF-prone features such as file uploads by URL, URL previews, or image rendering.
Bug bounty hunters and red teamers
While preparing for a bug bounty program to test for SSRF in cloud environments and internal network recon.
如何使用此範本
步驟 1
Access the Mind Map
Open the .xmind file in Xmind (desktop or web) to view the mind map.
步驟 2
Explore Techniques and Payloads
Expand branches like 'Attacks' and 'Bypass block list' to explore specific techniques and payloads.
步驟 3
Identify Vulnerable Parameters
Use the 'Where to find?' branch to identify common SSRF parameters in your target application.
步驟 4
Personalize Your Research Data
Customize the template by adding your own notes, payloads, or test results for each technique.
步驟 5
Export and Share Findings
Export the mind map as an image or PDF for sharing with your team or including in reports.
常見問題
The template includes 18 major branches covering SSRF attacks, DNS rebinding, bypass techniques, cloud metadata APIs, file read exploits, and more. It contains over 100 nodes with specific payloads and techniques.
Open the .xmind file in Xmind, then navigate through branches like 'Attacks' and 'Bypass block list' to find payloads. Use the 'Where to find?' section to identify SSRF-prone parameters like ?url=, ?uri=, and ?link=.
Yes, the template is free to download and fully editable in Xmind. You can add your own notes, payloads, or reorganize branches to suit your workflow.
The template covers address encoding (octal, decimal, hex), Unicode normalization, URL parser logic, IPv6 representations, and localhost aliases like http://0/ and http://127.1.
The 'Cloud meta API' branch provides AWS metadata endpoints (e.g., 169.254.169.254/latest/user-data) and tips to identify cloud providers. Use redirects or DNS rebinding to access internal metadata.
有好的範本想分享？
把你的心智圖範本分享給全球創作者，從你的作品中獲得收益。
免費模板