I know SSRF can be exploited with the
file:// protocol to read local files (something like path traversal) and also scan ports of hosts from the same network as the web server.
but how Blind SSRF can be exploited ?
What one can achieve with blind server-side request forgery depends heavily on the context of the vulnerability. Port scanning (XSPA) and hitting unauthenticated HTTP endpoints (e.g.
/shutdown :P) are possibly the most obvious things you can achieve, however, from my personal experience as a bug bounty hunter, people will attempt to chain blind SSRF with other issues in order to escalate the severity and exploitability as seen in http://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html.