From d4cb6556e5231c1607de0463d96e579204eacf6a Mon Sep 17 00:00:00 2001 From: RelunSec Date: Thu, 23 Jul 2026 10:12:17 -0400 Subject: [PATCH 1/2] Add Bypass using localhost TLD --- Server Side Request Forgery/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Server Side Request Forgery/README.md b/Server Side Request Forgery/README.md index a6cace1..2f02e17 100644 --- a/Server Side Request Forgery/README.md +++ b/Server Side Request Forgery/README.md @@ -19,6 +19,7 @@ * [Bypass Abusing URL Parsing Discrepancy](#bypass-abusing-url-parsing-discrepancy) * [Bypass PHP filter_var() Function](#bypass-php-filter_var-function) * [Bypass Using JAR Scheme](#bypass-using-jar-scheme) + * [Bypass Using TLD localhost](#bypass-using-tld-localhost) * [Exploitation via URL Scheme](#exploitation-via-url-scheme) * [file://](#file) * [http://](#http) @@ -292,6 +293,20 @@ In PHP 7.0.25, `filter_var()` function with the parameter `FILTER_VALIDATE_URL` ?> ``` +### Bypass Using TLD localhost + +There was a reserved tld called `.localhost`, it can accept arbiratry domains and resolves to the localhost ip, here is an example + +```powershell +$ ping ghahgahhah.localhost -c 1 +PING ghahgahhah.localhost (::1) 56 data bytes +64 bytes from ip6-localhost (::1): icmp_seq=1 ttl=64 time=0.070 ms + +--- ghahgahhah.localhost ping statistics --- +1 packets transmitted, 1 received, 0% packet loss, time 0ms +rtt min/avg/max/mdev = 0.070/0.070/0.070/0.000 ms +``` + ### Bypass Using JAR Scheme This attack technique is fully blind, you won't see the result. From 12e5d82ca65f2803f15e5ce74abc33674703dff2 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:07:09 +0200 Subject: [PATCH 2/2] Update localhost ping example in README Updated example in README to use 'PayloadsAllTheThings.localhost' instead of 'ghahgahhah.localhost'. --- Server Side Request Forgery/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Server Side Request Forgery/README.md b/Server Side Request Forgery/README.md index 2f02e17..f436a3e 100644 --- a/Server Side Request Forgery/README.md +++ b/Server Side Request Forgery/README.md @@ -298,11 +298,11 @@ In PHP 7.0.25, `filter_var()` function with the parameter `FILTER_VALIDATE_URL` There was a reserved tld called `.localhost`, it can accept arbiratry domains and resolves to the localhost ip, here is an example ```powershell -$ ping ghahgahhah.localhost -c 1 -PING ghahgahhah.localhost (::1) 56 data bytes +$ ping PayloadsAllTheThings.localhost -c 1 +PING PayloadsAllTheThings.localhost (::1) 56 data bytes 64 bytes from ip6-localhost (::1): icmp_seq=1 ttl=64 time=0.070 ms ---- ghahgahhah.localhost ping statistics --- +--- PayloadsAllTheThings.localhost ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.070/0.070/0.070/0.000 ms ```