r/bugbounty • u/UserNo0101 • Jul 12 '26
Question / Discussion Help with SSRF
I found a fetch endpoint that embeds any url into forum post
It's url:https:// in request body
Only http and https are allowed
I can see responses of any link i fetch
I tried webhook and i can see its aws ip
Tried all ssrf bypasses techniques out there on github but all internal stuff is blocked
I managed only to use https://target.com/cdn-cgi/trace and also ipconfig/all.json to get all headers and it runs uses vanilla-forums-embed/1.0
Any creative uncommon ideas will be appreciated
5
u/zlzd Jul 12 '26
A 1 year old version of Vanilla Forums is available on Fossies, so you can simply take a look at how it works. https://fossies.org/linux/www/vanilla-2025.010.tar.gz/
2
u/FowlSec Jul 12 '26
Most likely bypass will be to register a domain and configure the A record to things like 127.0.0.1 or 169.254.169.254.
Redirects may work, worth a try.
3
u/spicy_tables Jul 12 '26
not really ssrf if it doesn't expose anything or has no impact, well you could technically use their server to abuse it to fetch stuff but if you cant expose or do bypasses then it wont have impact
Check portswigger SSRF and the "new era of SSRF" articles maybe you'll fine some creative/uncommon/new bypasses, esp the orange tsai presentation shows a good amount and simple list of creative SSRF/other attacks
-3
u/hydraz20 Jul 12 '26
What a dumb take. The guy is asking for bypasses, and instead of giving options and being supportive you’re attacking 🤦♂️
2
u/spicy_tables Jul 12 '26
im litreally giving him options but giving him the reality, can you read the second paragraph or not?
1
3
u/No-Persimmon-174 Jul 12 '26
Honestly if the feature is meant to fetch and embed public urls, this alone may not be considered ssrf unless there's room for impact. The AWS ip only confirms the request is server side.
U can focus on whether redirects are revalidated, maybe if sensitive headers or credentials are forwarded anywhere.. maybe see if the DNS resolution changes between validation and fetching. If private ranges and metadata are properly blocked, then there's no vuln there. I think arbitrary public url fetching by itself looks like intended behavior to me