---
name: web-infrastructure-and-server-side
description: "A defensive review workflow for web infrastructure and server-side request weaknesses, covering SSRF, request smuggling, cache poisoning/deception, host header and DNS issues, exposed secrets, and misconfiguration; load it when reviewing a web service's outbound requests, caching, DNS, or exposed endpoints."
---

# Web infrastructure and server-side requests

SSRF, request smuggling, cache poisoning and deception, host headers, subdomain takeover, exposed secrets and misconfiguration in web services.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 23 newer reports it was not written from: following it finds about 24% of them._

## How to approach this area

This area is about trust boundaries between components: the client and the server, the server and its upstreams, the cache and the origin, DNS and the resource it points to. Weaknesses appear where two components parse, normalize, or resolve the same input differently, or where one side trusts a value the other controls.

**Map first.** Inventory every place the server makes an outbound request or builds a URL: fetchers, webhooks, image/PDF renderers, importers, redirect handlers, OAuth/token builders. List the caches in front of the app and what they key on. Enumerate DNS records for the target's domains and what they point at. Note exposed management, debug, and setup routes, and where secrets live (bundles, config, env).

**Questions that surface weaknesses:**
- Who controls each URL, host, header, or path that reaches a fetch, redirect, cache key, or file path?
- Does the validator and the fetcher agree on parsing (normalization, IP forms, redirects, scheme)?
- What is in the cache key versus what changes the response?
- Are hostnames resolved once and trusted, or re-resolved downstream?
- Do DNS records point at resources anyone could claim?
- Are management/setup endpoints reachable without auth?
- Do config fields flow into commands, loads, or downloads?

**Using the patterns.** Treat the list as a checklist of divergence points, not a script. For each candidate, trace the value from source to sink and confirm the two sides disagree. Prioritize by reachability and blast radius (cloud credentials, cross-tenant data, admin creation). Record evidence: the exact input, the two interpretations, and the observable effect. Stop at proof; do not escalate beyond demonstrating the gap.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### SSRF to cloud metadata endpoints
Server-side fetch of user URLs reaching 169.254.169.254 or private ranges, leaking cloud credentials

_22 reports · 11 confirmed bounties, median $3,500, up to $31,337._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-metadata-egress.md

### Request smuggling desync across hops
Hops disagreeing on request framing: CL vs TE, chunk/trailer parsing, bare CR, redirect body handling

_20 reports · 14 confirmed bounties, median $2,150, up to $46,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/request-smuggling-desync.md

### SSRF filter bypass via parser gaps
Validator and fetcher parse the same URL differently; check normalization, host anchoring, IP forms, per-hop redirects

_16 reports · 13 confirmed bounties, median $1,000, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-blocklist-bypass.md

### Dangling DNS subdomain takeover
DNS records pointing at unclaimed cloud, mail, or IP resources anyone can re-register

_16 reports · 11 confirmed bounties, median $513, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/subdomain-takeover-dangling.md

### Unkeyed header cache poisoning
Headers that change the response but are not in the cache key, poisoning shared caches

_14 reports · 6 confirmed bounties, median $1,750, up to $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/cache-poisoning-unkeyed-header.md

### SSRF via redirects and scheme changes
URL validated once, then redirect or scheme switch reaches file, gopher, or internal hosts

_13 reports · 6 confirmed bounties, median $650, up to $22,300._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-redirect-scheme.md

### Exposed secrets in bundles and config
Credentials readable by untrusted parties that grant server-side or cross-tenant authority

_11 reports · 9 confirmed bounties, median $3,500, up to $50,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/exposed-secrets-config.md

### DNS rebinding past hostname allowlists
Hostname checked once, re-resolved at request time, letting DNS answers diverge between check and use

_10 reports · 2 confirmed bounties: $100 and $500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/dns-rebinding-allowlist.md

### Renderer SSRF via user content
User content reaching a server-side renderer that fetches iframes, url() or UNC paths

_9 reports · 7 confirmed bounties, median $1,500, up to $25,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-renderer-fetch.md

### Host header injection to upstream URL
Server-side URL built from client Host or X-Forwarded-Host without allowlist, reaching internal hosts or leaking credentials

_9 reports · 5 confirmed bounties, median $4,000, up to $33,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/host-header-injection.md

### Path traversal in cache and file keys
User input joined into paths or URLs without canonicalization, escaping the intended namespace

_9 reports · 5 confirmed bounties, median $1,000, up to $3,495._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/path-traversal-cache-key.md

### Config Fields Reaching Command Sinks
User-editable config fields (version, path, driver, class) reaching shell, download, library load, or a validator skipped on one write path

_9 reports · 3 confirmed bounties, median $520, up to $2,480._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/config-field-command-injection.md

### Unbounded parser resource exhaustion
Per-item limits but no aggregate cap on count, size, overlap, or eviction

_7 reports · 6 confirmed bounties, median $1,449, up to $5,420._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/unbounded-parser-dos.md

### Cache deception via path and extension tricks
Cache classifies URL by extension or prefix while origin serves authenticated dynamic content under it

_6 reports · 4 confirmed bounties, median $2,300, up to $6,500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/cache-deception-path.md

### Unauthenticated debug and management endpoints
Debug, actuator, DevTools or daemon ports reachable without auth, exposing commands, tokens or secrets

_6 reports · 2 confirmed bounties: $1,550 and $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/exposed-debug-service.md

### Cross-origin redirect credential header leak
Redirect code strips some credential headers but forwards others, or skips stripping on one API surface

_6 reports · 4 confirmed bounties, median $405, up to $420._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/credential-header-redirect.md

### CRLF injection into headers and config
User input reaching headers, config files, or proxy directives without newline validation

_5 reports · 4 confirmed bounties, median $5,500, up to $20,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/crlf-header-injection-2.md

### Symlink following privilege escalation
Privileged reads, writes or deletes through paths a lower-privileged actor can replace with a symlink or reparse point

_5 reports · 3 confirmed bounties, median $1,250, up to $2,400._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/symlink-follow-privesc.md

### Cross-origin state and timing leaks
Per-user state or timing differences readable cross-origin via stream order, events, or response size

_5 reports · 4 confirmed bounties, median $890, up to $2,500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/cross-origin-state-leak.md

### Redirect credential leak via weak origin check
Credential-bearing requests follow redirects where same-origin check compares only hostname, not scheme and port

_4 reports · 4 confirmed bounties, median $590, up to $2,400._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/open-redirect-credential-leak.md

### Unverified custom domain binding
Does the service verify DNS or registrar ownership before binding a domain or zone to a tenant?

_4 reports · 4 confirmed bounties, median $1,231, up to $6,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/unverified-custom-domain.md

### Dangling bucket origin takeover
Subdomain, CDN origin, or script src pointing at a deleted or never-registered cloud storage bucket

_4 reports · one confirmed bounty: $500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/dangling-bucket-origin-takeover.md

### Hostname normalization mismatch in security checks
Security checks comparing hostnames or cookie domains without matching case, IDN, or trailing-dot normalization

_4 reports · one confirmed bounty: $2,540._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/domain-check-case-and-psl-bypass.md

### URL concatenation host override
User input glued into a base URL lets @, //, or absolute URLs swap the host

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-url-concat.md

### Compromised maintainer backdoored package release
Trusted package release adding deps, install/build hooks, or startup files that execute attacker code

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/supply-chain-maintainer-compromise.md

### World-writable permissions on sensitive paths
Archive extraction or daemon umask leaving world-writable files on paths later loaded as code or config

_3 reports · 3 confirmed bounties, median $2,400, up to $4,660._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/world-writable-permissions.md

### Exposed service with weak default credentials
Internet-reachable DB, registry or dev service reachable with default or guessable admin credentials

_3 reports · one confirmed bounty: $5,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/exposed-service-default-creds.md

### Connection pool reuse ignores security options
Does the pool's match key include every security-relevant option, compared with correct semantics?

_3 reports · 2 confirmed bounties: $480 and $2,400._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/connection-pool-security-mismatch.md

### Uncaught parse and nil-deref crashes
Network-response parsing and schema decoding without try/catch or nil checks, crashing the process

_3 reports · one confirmed bounty: $500._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/uncaught-parse-crash.md

### SSRF via media playlist references
Uploaded media reaching FFmpeg HLS/concat/subfile demuxers that fetch remote URLs or read local files

_3 reports · 2 confirmed bounties: $1,000 and $2,727._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-via-media-playlist-and-file-references.md

### Cache key collision via URL normalization
Cache key built from decoded or truncated input, collapsing distinct requests into one entry

_3 reports · 2 confirmed bounties: $1,120 and $1,250._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/cache-key-collision-via-url-normalization.md

### SSRF via injected upstream config directives
Attacker input reaching git -c flags, X-Accel-Redirect, or decoded path segments that steer server-side fetches

_3 reports · 2 confirmed bounties: $500 and $3,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-via-injected-upstream-config-directives.md

### Unauthenticated admin and setup endpoints
Setup, restore, decrypt, or dashboard routes reachable without auth that create admins or reveal credentials

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/unauthenticated-admin-endpoints.md

### Missing frame-ancestors enables framing
Pages or extensions lacking frame-ancestors or X-Frame-Options, especially on predictable subdomains

_2 reports · 2 confirmed bounties: $1,337 and $3,134._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/missing-frame-ancestors.md

### SSRF via unparsed URL encoding
Sanitizer or extension check that inspects raw URL text instead of the parsed, decoded request target

_2 reports · one confirmed bounty: $1,000._
Full pattern: https://bugbountylibrary.com/skills/web-infrastructure-and-server-side/ssrf-via-unparsed-encoding-in-url-sanitizer.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Preload requests leak real client IP**: Preconnect or extension requests fire before page load, bypassing proxy and exposing origin IP (https://bugbountylibrary.com/r/h1%3A1392211.md)
- **Privileged bridge property redefinable by page**: Native bridge or privileged object assigned after untrusted page scripts can redefine it (https://bugbountylibrary.com/r/h1%3A873614.md)
- **TLS verification disabled in proxy agent**: Proxy or agent config with rejectUnauthorized false or verify disabled for upstream TLS (https://bugbountylibrary.com/r/h1%3A54094.md)
- **Ambiguous revision or hash resolution**: Build or fetch logic resolving short hashes, branch names, or tags that can shadow a pinned revision (https://bugbountylibrary.com/r/h1%3A790634.md)
- **Content-Type substring match enables sniffing**: Upload or serve logic matching Content-Type by substring, allowing plugin execution despite nosniff (https://bugbountylibrary.com/r/h1%3A78158.md)
- **Manifest flags suppress security warnings**: Document manifest security flags silence warnings while embedded code still executes (https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- **Permission checks skip fd-based operations**: Path-based write checks that ignore already-open file descriptors or wildcard-truncated allowlists (https://bugbountylibrary.com/r/h1%3A2434819.md)
- **SSRF via trusted proxy headers**: Image or URL proxy trusts forwarded-proto or host headers for allowlist decisions (https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-static-site-generators-when-static-is-not-actually-static.md)
- **TLS verification silently disabled by falsy options**: Check whether undefined/null TLS options or failed negotiation steps silently skip certificate validation or mandatory TLS. (https://bugbountylibrary.com/r/h1%3A1278254.md)
- **URI or protocol handler abuse**: Handlers like search-ms or custom schemes redirecting to remote shares or attacker-controlled hosts (https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-anydesk-clickfix-metastealer-malware.md)
- **Unauthenticated ciphertext allows tampering**: Encryption without MAC or AEAD, letting attackers bit-flip ciphertext to alter decrypted values (https://bugbountylibrary.com/r/h1%3A108082.md)
- **Unauthenticated privileged RPC methods exposed**: Debug or admin RPC endpoints reachable without auth that mutate node or cluster state (https://bugbountylibrary.com/r/h1%3A324021.md)