Skip to content
Hugin capabilities

How to test for blind SSRF

Most SSRF is blind — the server makes the request but never shows you the response. You cannot see it in the body, so you have to make the server call something you control. This is how.

The method

  1. 1

    Stand up a listener you control

    You need a host that records DNS and HTTP callbacks and gives you a unique token per test. A self-hosted OAST server, or any host with a DNS name you own, works.

  2. 2

    Inject a callback URL

    Find parameters that take a URL or host — image import, webhook, PDF renderer, URL preview, SSO metadata, link unfurling. Point them at your listener with a unique subdomain so you know which input fired.

  3. 3

    Watch for DNS before HTTP

    A DNS callback with no HTTP request tells you the resolver ran but the connection was blocked or failed — still a finding, and it narrows the egress rules. HTTP tells you egress is open.

  4. 4

    Escalate to internal and metadata

    Once you have a callback, try internal ranges and the cloud metadata endpoint (for example 169.254.169.254) via the same parameter. A metadata response can mean credentials.

  5. 5

    Try alternate protocols

    If http and https are filtered, attempt other schemes the listener supports — gopher, FTP, SMTP — which can smuggle a crafted payload to an internal service that trusts it.

Do it in Hugin

Hugin runs its own out-of-band server on eight protocols (DNS, HTTP, HTTPS, SMTP, LDAP, FTP, SMB, raw TCP) on your machine, with per-test tokens — no cloud collaborator and no credits, and protocol coverage for payload smuggling, not just HTTP.

Out-of-band (OAST) server capability

Frequently asked

What is the difference between SSRF and blind SSRF?

In classic SSRF you can read the fetched content from the response. In blind SSRF you cannot — you infer the request happened from an out-of-band callback to a server you control.

Why does DNS fire but no HTTP request arrives?

The resolver ran, so the input reached the server, but the outbound connection was blocked or errored. That still confirms SSRF; it just means the egress path is restricted.

Put the method into a tool

Hugin is free to download, no account.

Download Hugin

More guides