Thread by @thebinarybot

I posted a thread on SSRF protection bypasses with different encodings yesterday.

But there's a lot more you can do to bypass filters.

Let's look at some of them below. ( Also, comment your most used and favourite bypasses )

🧵👇

1. DNS Pinning

To get an A-record that resolves into IP, use the following subdomain.

make-<IP>-rr.1u.ms

2. Bypass with Open Redirection

Eg. /nextPage?path=192.168.0.10/secretInfo

3. If SSRF allows only whitelisted domains, try these

3.1 https://expected-host@evil-host
3.2 https://evil-host#expected-host
3.3 https://expected-host.evil-host
3.4 Combing them together : evil-host%09expected-host

4. Use IPv4 mapped IPv6 addresses

Eg. [::ffff:127.0.0.1] , [::ffff:7f00:1]

5. Use enclosed alphanumerics

Eg : ⑫７｡⓪．𝟢。𝟷

The idea is to be creative to bypass certain blacklisted functionalities and if whitelisted use different bypasses as present in point 3.

Link to bypasses using different encodings :

https://twitter.com/thebinarybot/status/1447172304463564806?t=EO3M2wSi2Xz71hVwvN27ww&s=19

Hey, I'm Nithin 👋

I tweet on the following topics :

🔹 Cybersecurity
🔹 Blockchain and Crypto
🔹 Web Development and Tech
🔹 Books and Productivity

Follow @thebinarybot if any topic above interests you.

#bugbounty #bugbountytips #webdevelopment #100DaysOfCode #infosec