5 ms·

Added a check against localhost thanks for pointing that out.

• deleted 5y ago
  [deleted]
• bryanh 5y ago
  https://2130706433:443/ https://2130706433:443/ https://0177.0.0.01:443/ https://0177.0.0.01:443/
  • busymom0 5y ago
    Can someone educate me on why these 2 links resolve to localhost?
    • Zacru 5y ago
      I think the first is the 32 bit int version of 127.0.0.1, and 0177 is the octal representation of 127.
      • Zacru 5y ago
        Along those lines, you can also use hex https://0x7f.0.0.0x01:443/ https://0x7f.0.0.0x01:443/
• karmanyaahm 5y ago
  http://[::1] http://[::1] still works btw
  • soheil 5y ago
    Just fixed. Thanks.
• deleted 5y ago
  [deleted]
• remram 5y ago
  You will not win against SSRF using a blocklist of names. You need a comprehensive solution that is designed for this and will check the end address after redirections, DNS resolutions, ... have been applied in whatever library you use for HTTP. An example is advocate for Python https://github.com/JordanMilne/Advocate https://github.com/JordanMilne/Advocate