Server-Side Request Forgery

Recursos cross-platform para Server-Side Request Forgery: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

​

Server-Side Request Forgery

Esta página agrega los recursos para practicar Server-Side Request Forgery de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

​

Recursos curados

Fuente	Enlace
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/index.html

​

Máquinas HTB que practican Server-Side Request Forgery (10)

Máquina	SO	Dificultad
AdmirerToo	Linux	HARD
Dab	Linux	HARD
Forge	Linux	MEDIUM
Fulcrum	Linux	INSANE
Haircut	Linux	MEDIUM
Kotarak	Linux	HARD
Love	Windows	EASY
Minion	Windows	INSANE
OverGraph	Linux	HARD
Time	Linux	MEDIUM

​

Labs PortSwigger que practican Server-Side Request Forgery (11)

Lab	Dificultad	Topic	Oficial
Basic SSRF against another back-end system	APPRENTICE	SSRF (Server-Side Request Forgery)	Abrir
Basic SSRF against the local server	APPRENTICE	SSRF (Server-Side Request Forgery)	Abrir
Blind SSRF with Shellshock exploitation	APPRENTICE	SSRF (Server-Side Request Forgery)	Abrir
Exploiting XXE to perform SSRF attacks	APPRENTICE	XXE (XML External Entity)	Abrir
SSRF with whitelist-based input filter	APPRENTICE	SSRF (Server-Side Request Forgery)	Abrir
Blind SSRF with out-of-band detection	PRACTITIONER	SSRF (Server-Side Request Forgery)	Abrir
Routing-based SSRF	PRACTITIONER	HTTP Host Header Attacks	Abrir
SSRF via flawed request parsing	PRACTITIONER	HTTP Host Header Attacks	Abrir
SSRF via OpenID dynamic client registration	PRACTITIONER	OAuth Authentication	Abrir
SSRF with blacklist-based input filter	PRACTITIONER	SSRF (Server-Side Request Forgery)	Abrir
SSRF with filter bypass via open redirection vulnerability	PRACTITIONER	SSRF (Server-Side Request Forgery)	Abrir

​

Rooms TryHackMe que practican Server-Side Request Forgery (4)

Room	Dificultad	Tipo	Acceso	Oficial
Advent of Cyber 2023	EASY	Walkthrough	🟢 Free	Abrir
Intro to SSRF	EASY	Walkthrough	🔵 VIP	Abrir
Wordpress: CVE-2021-29447	EASY	Challenge	🟢 Free	Abrir
SSRF	MEDIUM	Walkthrough	🟢 Free	Abrir

​

Skills relacionadas

• /skills/xss
• /skills/rce

---

← Volver al glosario completo

Última actualización: 2026-05-09