If i run a SSRF payload and it returns 200 ok, does it means the target is vulnerable? There is nothing that would be considerable leaked like data in a body, just the content-type to date such stuff

1 Answer 1


Not necessarily. Servers return status codes for all kinds of reasons depending on their configuration. For all you know it's stripping your payload or filtering it out and discarding it entirely. The simplest way to confirm an SSRF vulnerability - assuming this is a black box test and you can't check the server logs yourself - would be an out-of-band interaction. See if you can get it to connect to https://webhook.site/.

There are caveats to that too, e.g. a firewall may prevent external connections but permit internal ones etc., but an SSRF masterclass is probably outside the scope of this comment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .