How to: SSRF (Server-Side Request Forgery)
https://lab.wallarm.com/blind-ssrf-exploitation/
# There is such a thing as SSRF. There’s lots of information about it, but here is my quick summary.

https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/
# A Glossary of Blind SSRF Chains.

https://github.com/assetnote/surf
# surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering them into a list of externally facing and internally facing hosts.
```surf -l example.txt -t 10 -c 200```

https://wya.pl/2021/12/20/bring-your-own-ssrf-the-gateway-actuator/
# BRING YOUR OWN SSRF – THE GATEWAY ACTUATOR.

https://blog.tneitzel.eu/posts/01-attacking-java-rmi-via-ssrf/
# Attacking Java RMI via SSRF.

https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html#runtimes-api-next
# Got SSRF in a AWS lambda?
```http://localhost:9001/2018-06-01/runtime/invocation/next```

https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
# This cheat sheet contains payloads for bypassing URL validation. These wordlists are useful for attacks such as server-side request forgery, CORS misconfigurations, and open redirection.

https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/
# Blind Server-Side Request Forgery bugs are tricky to exploit, and obtaining the full HTTP response is one of the primary goals with any SSRF vulnerability. With modern cloud architectures, leaking the full HTTP response can often lead to cloud environment compromise if we can obtain the security credentials from the metadata IP.
# However, what if you’re in a situation where the application just refuses to return the full HTTP response? Perhaps it’s performing some parsing logic, and your response does not fit its specifications, leading to an uneventful parsing error. These were the same challenges we faced recently when looking at widely used enterprise software.
# We saw some unexpected behavior in this software that led to the leakage of the full redirect chain, including the final 200 OK response. We wanted to take some time today to blog about the issue, as it could lead to other SSRF vulnerabilities being exploitable in a similar way. Since this technique was surprisingly successful in this popular enterprise product, this pattern may hold true elsewhere.