1. What protocols does the client support?
   1. ftp:// (File Transfer Protocol)
   2. dict:// ( dictionary network protocol)
   3. gopher:// (File Distribution)
   4. File:// (File URI Scheme)
   5. ldap:// ( Lightweight Directory Access Protocol)
   6. AWS Meta-Data http://169.254.169.254/latest/dynamic/instance-identity/
   7. ssh:// (Secure Shell)
   8. smb:// (Server Message Block)
   9. http://
   10. https://
2. Bypasses
   1. Redirect using external server you control
   2. numberic ip conversion for blacklist bypasses.
   3. Shortern URLs: http://127.1
3. What else can I do?
   1. Port scanning of internal network
   2. Try and view internal services
      1. Elastic Cache
      2. File servers
      3. Databases
      4. Network infrastruction Switches, Routers, Firewalls etc
   3. Directory traversal
   4. AWS & GCP meta-data exploitation
   5. Send an email using localhost SMTP?
4. What to look for?
   1. Anywhere a system addressable string shows up (IP, domain name, email address, etc).
   2. queryParams taking a URL as input
   3. Ability to upload files and templates
   4. Fuzzing headers
      1. Location
      2. Referrer
      3. X-Forwarded-From
   5. Webhooks
   6. PDF Generators
   7. Document Parsers
5. Can I read responses?
   1. YES If I can read the response then proving impact is a breeze: we just need to identify an internal service that responds to whatever protocols we have access to and read a response from it.
   2. NO is there any additional information given to me based on the availability of the receiving system? If the port isn’t open, does an error get returned? If the system doesn’t speak HTTP but is receiving traffic, what happens?
6. Where are we?
   1. Are we on IaaS? If yes, can we access the metadata service?
   2. More Custom? Start digging and see what we can find
7. https://medium.com/@d0nut/piercing-the-veal-short-stories-to-read-with-friends-4aa86d606fc5
8. SSRF is the ability to direct a system in a privileged network position to issue a request to another system within the trust boundary.
   1. Thank you @d0nut
9. Internal Network Addresses in CIDR
   1. 10.0.0.0/8
   2. 127.0.0.1/32
   3. 172.16.0.0/12
   4. 192.168.0.0/16
   5. Don't forget numeric version!