r/bugbounty•
bussymastah

Timing-based Blind SSRF

Question / Discussion

How valid is enumeration via Blind SSRF? If for instance an appended parameter of /OpenView&r=2678 (default load for this particular web app) has instead /OpenView&r=http://127.0.0.1:9999 which responds in ~180ms, same with :443 - but /OpenView&r=http://127.0.0.1:3306 takes 16000ms to respond

Posted Dec 10, 2025, 2:54 PM UTC

415
Loading comments…