Redirector for SSRF v1.3

Redirects avoid regex-based filters that only inspect the initial URL.

# 0 - Localhost & Internal

# Base
/r/0/1   - localhost
/r/0/2   - 127.0.0.1
/r/0/3   - 127.x.x.x
/r/0/4   - octal
/r/0/5   - decimal
/r/0/6   - hex
/r/0/7   - Static DNS rebind
/r/0/8   - TOCTOU DNS rebind
/r/0/9   - trailing dot
/r/0/10  - IPv6-mapped
/r/0/11  - native IPv6
/r/0/12  - userinfo
/r/0/13  - zero
/r/0/14  - zero quad
/r/0/15  - 10.0.0.1
/r/0/16  - 192.168.1.1

# server-status
/r/0/17  - server-status, localhost
/r/0/18  - server-status, 127.0.0.1
/r/0/19  - server-status, 127.x.x.x
/r/0/20  - server-status, octal
/r/0/21  - server-status, decimal
/r/0/22  - server-status, hex
/r/0/23  - server-status, Static DNS rebind
/r/0/24  - server-status, TOCTOU DNS rebind
/r/0/25  - server-status, trailing dot
/r/0/26  - server-status, IPv6-mapped
/r/0/27  - server-status, native IPv6
/r/0/28  - server-status, userinfo
/r/0/29  - server-status, zero
/r/0/30  - server-status, zero quad

# server-info
/r/0/31  - server-info, localhost
/r/0/32  - server-info, 127.0.0.1
/r/0/33  - server-info, 127.x.x.x
/r/0/34  - server-info, octal
/r/0/35  - server-info, decimal
/r/0/36  - server-info, hex
/r/0/37  - server-info, Static DNS rebind
/r/0/38  - server-info, TOCTOU DNS rebind
/r/0/39  - server-info, trailing dot
/r/0/40  - server-info, IPv6-mapped
/r/0/41  - server-info, native IPv6
/r/0/42  - server-info, userinfo
/r/0/43  - server-info, zero
/r/0/44  - server-info, zero quad

# actuator/health
/r/0/45  - actuator/health, localhost
/r/0/46  - actuator/health, 127.0.0.1
/r/0/47  - actuator/health, 127.x.x.x
/r/0/48  - actuator/health, octal
/r/0/49  - actuator/health, decimal
/r/0/50  - actuator/health, hex
/r/0/51  - actuator/health, Static DNS rebind
/r/0/52  - actuator/health, TOCTOU DNS rebind
/r/0/53  - actuator/health, trailing dot
/r/0/54  - actuator/health, IPv6-mapped
/r/0/55  - actuator/health, native IPv6
/r/0/56  - actuator/health, userinfo
/r/0/57  - actuator/health, zero
/r/0/58  - actuator/health, zero quad

# phpMyAdmin
/r/0/59  - phpMyAdmin, localhost
/r/0/60  - phpMyAdmin, 127.0.0.1
/r/0/61  - phpMyAdmin, 127.x.x.x
/r/0/62  - phpMyAdmin, octal
/r/0/63  - phpMyAdmin, decimal
/r/0/64  - phpMyAdmin, hex
/r/0/65  - phpMyAdmin, Static DNS rebind
/r/0/66  - phpMyAdmin, TOCTOU DNS rebind
/r/0/67  - phpMyAdmin, trailing dot
/r/0/68  - phpMyAdmin, IPv6-mapped
/r/0/69  - phpMyAdmin, native IPv6
/r/0/70  - phpMyAdmin, userinfo
/r/0/71  - phpMyAdmin, zero
/r/0/72  - phpMyAdmin, zero quad

# admin
/r/0/73  - admin, localhost
/r/0/74  - admin, 127.0.0.1
/r/0/75  - admin, 127.x.x.x
/r/0/76  - admin, octal
/r/0/77  - admin, decimal
/r/0/78  - admin, hex
/r/0/79  - admin, Static DNS rebind
/r/0/80  - admin, TOCTOU DNS rebind
/r/0/81  - admin, trailing dot
/r/0/82  - admin, IPv6-mapped
/r/0/83  - admin, native IPv6
/r/0/84  - admin, userinfo
/r/0/85  - admin, zero
/r/0/86  - admin, zero quad

# Base (header spray)
/r/0/87  - localhost, header spray domain
/r/0/88  - localhost, header spray IP
/r/0/89  - 127.0.0.1, header spray domain
/r/0/90  - 127.0.0.1, header spray IP
/r/0/91  - 127.x.x.x, header spray domain
/r/0/92  - 127.x.x.x, header spray IP
/r/0/93  - octal, header spray domain
/r/0/94  - octal, header spray IP
/r/0/95  - decimal, header spray domain
/r/0/96  - decimal, header spray IP
/r/0/97  - hex, header spray domain
/r/0/98  - hex, header spray IP
/r/0/99  - Static DNS rebind, header spray domain
/r/0/100 - Static DNS rebind, header spray IP
/r/0/101 - TOCTOU DNS rebind, header spray domain
/r/0/102 - TOCTOU DNS rebind, header spray IP
/r/0/103 - trailing dot, header spray domain
/r/0/104 - trailing dot, header spray IP
/r/0/105 - IPv6-mapped, header spray domain
/r/0/106 - IPv6-mapped, header spray IP
/r/0/107 - native IPv6, header spray domain
/r/0/108 - native IPv6, header spray IP
/r/0/109 - userinfo, header spray domain
/r/0/110 - userinfo, header spray IP
/r/0/111 - zero, header spray domain
/r/0/112 - zero, header spray IP
/r/0/113 - zero quad, header spray domain
/r/0/114 - zero quad, header spray IP
/r/0/115 - 10.0.0.1, header spray domain
/r/0/116 - 10.0.0.1, header spray IP
/r/0/117 - 192.168.1.1, header spray domain
/r/0/118 - 192.168.1.1, header spray IP

# server-status (header spray)
/r/0/119 - server-status, localhost, header spray domain
/r/0/120 - server-status, localhost, header spray IP
/r/0/121 - server-status, 127.0.0.1, header spray domain
/r/0/122 - server-status, 127.0.0.1, header spray IP
/r/0/123 - server-status, 127.x.x.x, header spray domain
/r/0/124 - server-status, 127.x.x.x, header spray IP
/r/0/125 - server-status, octal, header spray domain
/r/0/126 - server-status, octal, header spray IP
/r/0/127 - server-status, decimal, header spray domain
/r/0/128 - server-status, decimal, header spray IP
/r/0/129 - server-status, hex, header spray domain
/r/0/130 - server-status, hex, header spray IP
/r/0/131 - server-status, Static DNS rebind, header spray domain
/r/0/132 - server-status, Static DNS rebind, header spray IP
/r/0/133 - server-status, TOCTOU DNS rebind, header spray domain
/r/0/134 - server-status, TOCTOU DNS rebind, header spray IP
/r/0/135 - server-status, trailing dot, header spray domain
/r/0/136 - server-status, trailing dot, header spray IP
/r/0/137 - server-status, IPv6-mapped, header spray domain
/r/0/138 - server-status, IPv6-mapped, header spray IP
/r/0/139 - server-status, native IPv6, header spray domain
/r/0/140 - server-status, native IPv6, header spray IP
/r/0/141 - server-status, userinfo, header spray domain
/r/0/142 - server-status, userinfo, header spray IP
/r/0/143 - server-status, zero, header spray domain
/r/0/144 - server-status, zero, header spray IP
/r/0/145 - server-status, zero quad, header spray domain
/r/0/146 - server-status, zero quad, header spray IP

# server-info (header spray)
/r/0/147 - server-info, localhost, header spray domain
/r/0/148 - server-info, localhost, header spray IP
/r/0/149 - server-info, 127.0.0.1, header spray domain
/r/0/150 - server-info, 127.0.0.1, header spray IP
/r/0/151 - server-info, 127.x.x.x, header spray domain
/r/0/152 - server-info, 127.x.x.x, header spray IP
/r/0/153 - server-info, octal, header spray domain
/r/0/154 - server-info, octal, header spray IP
/r/0/155 - server-info, decimal, header spray domain
/r/0/156 - server-info, decimal, header spray IP
/r/0/157 - server-info, hex, header spray domain
/r/0/158 - server-info, hex, header spray IP
/r/0/159 - server-info, Static DNS rebind, header spray domain
/r/0/160 - server-info, Static DNS rebind, header spray IP
/r/0/161 - server-info, TOCTOU DNS rebind, header spray domain
/r/0/162 - server-info, TOCTOU DNS rebind, header spray IP
/r/0/163 - server-info, trailing dot, header spray domain
/r/0/164 - server-info, trailing dot, header spray IP
/r/0/165 - server-info, IPv6-mapped, header spray domain
/r/0/166 - server-info, IPv6-mapped, header spray IP
/r/0/167 - server-info, native IPv6, header spray domain
/r/0/168 - server-info, native IPv6, header spray IP
/r/0/169 - server-info, userinfo, header spray domain
/r/0/170 - server-info, userinfo, header spray IP
/r/0/171 - server-info, zero, header spray domain
/r/0/172 - server-info, zero, header spray IP
/r/0/173 - server-info, zero quad, header spray domain
/r/0/174 - server-info, zero quad, header spray IP

# actuator/health (header spray)
/r/0/175 - actuator/health, localhost, header spray domain
/r/0/176 - actuator/health, localhost, header spray IP
/r/0/177 - actuator/health, 127.0.0.1, header spray domain
/r/0/178 - actuator/health, 127.0.0.1, header spray IP
/r/0/179 - actuator/health, 127.x.x.x, header spray domain
/r/0/180 - actuator/health, 127.x.x.x, header spray IP
/r/0/181 - actuator/health, octal, header spray domain
/r/0/182 - actuator/health, octal, header spray IP
/r/0/183 - actuator/health, decimal, header spray domain
/r/0/184 - actuator/health, decimal, header spray IP
/r/0/185 - actuator/health, hex, header spray domain
/r/0/186 - actuator/health, hex, header spray IP
/r/0/187 - actuator/health, Static DNS rebind, header spray domain
/r/0/188 - actuator/health, Static DNS rebind, header spray IP
/r/0/189 - actuator/health, TOCTOU DNS rebind, header spray domain
/r/0/190 - actuator/health, TOCTOU DNS rebind, header spray IP
/r/0/191 - actuator/health, trailing dot, header spray domain
/r/0/192 - actuator/health, trailing dot, header spray IP
/r/0/193 - actuator/health, IPv6-mapped, header spray domain
/r/0/194 - actuator/health, IPv6-mapped, header spray IP
/r/0/195 - actuator/health, native IPv6, header spray domain
/r/0/196 - actuator/health, native IPv6, header spray IP
/r/0/197 - actuator/health, userinfo, header spray domain
/r/0/198 - actuator/health, userinfo, header spray IP
/r/0/199 - actuator/health, zero, header spray domain
/r/0/200 - actuator/health, zero, header spray IP
/r/0/201 - actuator/health, zero quad, header spray domain
/r/0/202 - actuator/health, zero quad, header spray IP

# phpMyAdmin (header spray)
/r/0/203 - phpMyAdmin, localhost, header spray domain
/r/0/204 - phpMyAdmin, localhost, header spray IP
/r/0/205 - phpMyAdmin, 127.0.0.1, header spray domain
/r/0/206 - phpMyAdmin, 127.0.0.1, header spray IP
/r/0/207 - phpMyAdmin, 127.x.x.x, header spray domain
/r/0/208 - phpMyAdmin, 127.x.x.x, header spray IP
/r/0/209 - phpMyAdmin, octal, header spray domain
/r/0/210 - phpMyAdmin, octal, header spray IP
/r/0/211 - phpMyAdmin, decimal, header spray domain
/r/0/212 - phpMyAdmin, decimal, header spray IP
/r/0/213 - phpMyAdmin, hex, header spray domain
/r/0/214 - phpMyAdmin, hex, header spray IP
/r/0/215 - phpMyAdmin, Static DNS rebind, header spray domain
/r/0/216 - phpMyAdmin, Static DNS rebind, header spray IP
/r/0/217 - phpMyAdmin, TOCTOU DNS rebind, header spray domain
/r/0/218 - phpMyAdmin, TOCTOU DNS rebind, header spray IP
/r/0/219 - phpMyAdmin, trailing dot, header spray domain
/r/0/220 - phpMyAdmin, trailing dot, header spray IP
/r/0/221 - phpMyAdmin, IPv6-mapped, header spray domain
/r/0/222 - phpMyAdmin, IPv6-mapped, header spray IP
/r/0/223 - phpMyAdmin, native IPv6, header spray domain
/r/0/224 - phpMyAdmin, native IPv6, header spray IP
/r/0/225 - phpMyAdmin, userinfo, header spray domain
/r/0/226 - phpMyAdmin, userinfo, header spray IP
/r/0/227 - phpMyAdmin, zero, header spray domain
/r/0/228 - phpMyAdmin, zero, header spray IP
/r/0/229 - phpMyAdmin, zero quad, header spray domain
/r/0/230 - phpMyAdmin, zero quad, header spray IP

# admin (header spray)
/r/0/231 - admin, localhost, header spray domain
/r/0/232 - admin, localhost, header spray IP
/r/0/233 - admin, 127.0.0.1, header spray domain
/r/0/234 - admin, 127.0.0.1, header spray IP
/r/0/235 - admin, 127.x.x.x, header spray domain
/r/0/236 - admin, 127.x.x.x, header spray IP
/r/0/237 - admin, octal, header spray domain
/r/0/238 - admin, octal, header spray IP
/r/0/239 - admin, decimal, header spray domain
/r/0/240 - admin, decimal, header spray IP
/r/0/241 - admin, hex, header spray domain
/r/0/242 - admin, hex, header spray IP
/r/0/243 - admin, Static DNS rebind, header spray domain
/r/0/244 - admin, Static DNS rebind, header spray IP
/r/0/245 - admin, TOCTOU DNS rebind, header spray domain
/r/0/246 - admin, TOCTOU DNS rebind, header spray IP
/r/0/247 - admin, trailing dot, header spray domain
/r/0/248 - admin, trailing dot, header spray IP
/r/0/249 - admin, IPv6-mapped, header spray domain
/r/0/250 - admin, IPv6-mapped, header spray IP
/r/0/251 - admin, native IPv6, header spray domain
/r/0/252 - admin, native IPv6, header spray IP
/r/0/253 - admin, userinfo, header spray domain
/r/0/254 - admin, userinfo, header spray IP
/r/0/255 - admin, zero, header spray domain
/r/0/256 - admin, zero, header spray IP
/r/0/257 - admin, zero quad, header spray domain
/r/0/258 - admin, zero quad, header spray IP

# 1 - Cloud Metadata

# Cloud
/r/1/1   - AWS
/r/1/2   - AWS, octal
/r/1/3   - AWS, decimal
/r/1/4   - AWS, hex
/r/1/5   - AWS, Static DNS rebind
/r/1/6   - AWS, TOCTOU DNS rebind
/r/1/7   - AWS, trailing dot
/r/1/8   - AWS, IPv6-mapped
/r/1/9   - AWS, native IPv6
/r/1/10  - AWS, userinfo
/r/1/11  - AWS, IAM role list
/r/1/12  - AWS, IAM role list, octal
/r/1/13  - AWS, IAM role list, decimal
/r/1/14  - AWS, IAM role list, hex
/r/1/15  - AWS, IAM role list, Static DNS rebind
/r/1/16  - AWS, IAM role list, TOCTOU DNS rebind
/r/1/17  - AWS, IAM role list, userinfo
/r/1/18  - AWS, ECS task credentials
/r/1/19  - AWS, ECS task credentials, Static DNS rebind
/r/1/20  - AWS, ECS task credentials, TOCTOU DNS rebind
/r/1/21  - AWS, ECS task credentials, userinfo
/r/1/22  - GCP
/r/1/23  - GCP, octal
/r/1/24  - GCP, decimal
/r/1/25  - GCP, hex
/r/1/26  - GCP, Static DNS rebind
/r/1/27  - GCP, TOCTOU DNS rebind
/r/1/28  - GCP, trailing dot
/r/1/29  - GCP, IPv6-mapped
/r/1/30  - GCP, userinfo
/r/1/31  - GCP, deprecated path, no header needed
/r/1/32  - GCP, deprecated path, Static DNS rebind
/r/1/33  - GCP, deprecated path, TOCTOU DNS rebind
/r/1/34  - GCP, deprecated path, octal
/r/1/35  - GCP, service account token
/r/1/36  - GCP, service account token, Static DNS rebind
/r/1/37  - GCP, service account token, TOCTOU DNS rebind
/r/1/38  - GCP, service account token, no header (v1beta1)
/r/1/39  - GCP, service account token, userinfo
/r/1/40  - Azure
/r/1/41  - Azure, octal
/r/1/42  - Azure, decimal
/r/1/43  - Azure, hex
/r/1/44  - Azure, Static DNS rebind
/r/1/45  - Azure, TOCTOU DNS rebind
/r/1/46  - Azure, trailing dot
/r/1/47  - Azure, IPv6-mapped
/r/1/48  - Azure, userinfo
/r/1/49  - Azure, managed identity token
/r/1/50  - Azure, managed identity token, Static DNS rebind
/r/1/51  - Azure, managed identity token, TOCTOU DNS rebind
/r/1/52  - Azure, managed identity token, octal
/r/1/53  - Azure, managed identity token, userinfo

# 2 - Local File Read

# LFR
/r/2/1   - baseline, no bypass needed
/r/2/2   - baseline, no bypass needed, 127.0.0.1
/r/2/3   - baseline, no bypass needed, 127.x.x.x
/r/2/4   - baseline, no bypass needed, octal
/r/2/5   - baseline, no bypass needed, decimal
/r/2/6   - baseline, no bypass needed, hex
/r/2/7   - baseline, no bypass needed, Static DNS rebind
/r/2/8   - baseline, no bypass needed, TOCTOU DNS rebind
/r/2/9   - baseline, no bypass needed, trailing dot
/r/2/10  - baseline, no bypass needed, IPv6-mapped
/r/2/11  - baseline, no bypass needed, native IPv6
/r/2/12  - baseline, no bypass needed, userinfo
/r/2/13  - baseline, no bypass needed, zero
/r/2/14  - baseline, no bypass needed, zero quad
/r/2/15  - query-mimic, curl
/r/2/16  - encoded query-mimic, curl
/r/2/17  - double-encoded slash, curl
/r/2/18  - double-encoded slash + query, curl
/r/2/19  - path traversal, file_get_contents
/r/2/20  - path traversal, file_get_contents, 127.0.0.1
/r/2/21  - path traversal, file_get_contents, 127.x.x.x
/r/2/22  - path traversal, file_get_contents, octal
/r/2/23  - path traversal, file_get_contents, decimal
/r/2/24  - path traversal, file_get_contents, hex
/r/2/25  - path traversal, file_get_contents, Static DNS rebind
/r/2/26  - path traversal, file_get_contents, TOCTOU DNS rebind
/r/2/27  - path traversal, file_get_contents, trailing dot
/r/2/28  - path traversal, file_get_contents, IPv6-mapped
/r/2/29  - path traversal, file_get_contents, native IPv6
/r/2/30  - path traversal, file_get_contents, userinfo
/r/2/31  - path traversal, file_get_contents, zero
/r/2/32  - path traversal, file_get_contents, zero quad
/r/2/33  - encoded path traversal, file_get_contents
/r/2/34  - encoded path traversal, file_get_contents, 127.0.0.1
/r/2/35  - encoded path traversal, file_get_contents, 127.x.x.x
/r/2/36  - encoded path traversal, file_get_contents, octal
/r/2/37  - encoded path traversal, file_get_contents, decimal
/r/2/38  - encoded path traversal, file_get_contents, hex
/r/2/39  - encoded path traversal, file_get_contents, Static DNS rebind
/r/2/40  - encoded path traversal, file_get_contents, TOCTOU DNS rebind
/r/2/41  - encoded path traversal, file_get_contents, trailing dot
/r/2/42  - encoded path traversal, file_get_contents, IPv6-mapped
/r/2/43  - encoded path traversal, file_get_contents, native IPv6
/r/2/44  - encoded path traversal, file_get_contents, userinfo
/r/2/45  - encoded path traversal, file_get_contents, zero
/r/2/46  - encoded path traversal, file_get_contents, zero quad
/r/2/47  - shell variable split, exec
/r/2/48  - command substitution split, exec
/r/2/49  - shell variable split, encoded slash, exec
/r/2/50  - command substitution split, encoded slash, exec
/r/2/51  - shell variable split, encoded slash + query, exec
/r/2/52  - command substitution split, encoded slash + query, exec
/r/2/53  - polyglot, all 3 sinks
/r/2/54  - polyglot, all 3 sinks, 127.0.0.1
/r/2/55  - polyglot, all 3 sinks, 127.x.x.x
/r/2/56  - polyglot, all 3 sinks, octal
/r/2/57  - polyglot, all 3 sinks, decimal
/r/2/58  - polyglot, all 3 sinks, hex
/r/2/59  - polyglot, all 3 sinks, Static DNS rebind
/r/2/60  - polyglot, all 3 sinks, TOCTOU DNS rebind
/r/2/61  - polyglot, all 3 sinks, trailing dot
/r/2/62  - polyglot, all 3 sinks, IPv6-mapped
/r/2/63  - polyglot, all 3 sinks, native IPv6
/r/2/64  - polyglot, all 3 sinks, userinfo
/r/2/65  - polyglot, all 3 sinks, zero
/r/2/66  - polyglot, all 3 sinks, zero quad

# 3 - Internal Protocols

# Protocols
/r/3/1   - Redis, INFO command
/r/3/2   - Redis, INFO command, 127.x.x.x
/r/3/3   - Redis, INFO command, octal
/r/3/4   - Redis, INFO command, decimal
/r/3/5   - Redis, INFO command, hex
/r/3/6   - Redis, INFO command, Static DNS rebind
/r/3/7   - Redis, INFO command, TOCTOU DNS rebind
/r/3/8   - Redis, INFO command, trailing dot
/r/3/9   - Redis, INFO command, IPv6-mapped
/r/3/10  - Redis, INFO command, native IPv6
/r/3/11  - Redis, INFO command, userinfo
/r/3/12  - Redis, INFO command, zero
/r/3/13  - Redis, INFO command, zero quad
/r/3/14  - Memcached, stats command
/r/3/15  - Memcached, stats command, 127.x.x.x
/r/3/16  - Memcached, stats command, octal
/r/3/17  - Memcached, stats command, decimal
/r/3/18  - Memcached, stats command, hex
/r/3/19  - Memcached, stats command, Static DNS rebind
/r/3/20  - Memcached, stats command, TOCTOU DNS rebind
/r/3/21  - Memcached, stats command, trailing dot
/r/3/22  - Memcached, stats command, IPv6-mapped
/r/3/23  - Memcached, stats command, native IPv6
/r/3/24  - Memcached, stats command, userinfo
/r/3/25  - Memcached, stats command, zero
/r/3/26  - Memcached, stats command, zero quad
/r/3/27  - ZooKeeper, ruok four-letter command
/r/3/28  - ZooKeeper, ruok four-letter command, 127.x.x.x
/r/3/29  - ZooKeeper, ruok four-letter command, octal
/r/3/30  - ZooKeeper, ruok four-letter command, decimal
/r/3/31  - ZooKeeper, ruok four-letter command, hex
/r/3/32  - ZooKeeper, ruok four-letter command, Static DNS rebind
/r/3/33  - ZooKeeper, ruok four-letter command, TOCTOU DNS rebind
/r/3/34  - ZooKeeper, ruok four-letter command, trailing dot
/r/3/35  - ZooKeeper, ruok four-letter command, IPv6-mapped
/r/3/36  - ZooKeeper, ruok four-letter command, native IPv6
/r/3/37  - ZooKeeper, ruok four-letter command, userinfo
/r/3/38  - ZooKeeper, ruok four-letter command, zero
/r/3/39  - ZooKeeper, ruok four-letter command, zero quad
/r/3/40  - SMTP, HELO handshake
/r/3/41  - SMTP, HELO handshake, 127.x.x.x
/r/3/42  - SMTP, HELO handshake, octal
/r/3/43  - SMTP, HELO handshake, decimal
/r/3/44  - SMTP, HELO handshake, hex
/r/3/45  - SMTP, HELO handshake, Static DNS rebind
/r/3/46  - SMTP, HELO handshake, TOCTOU DNS rebind
/r/3/47  - SMTP, HELO handshake, trailing dot
/r/3/48  - SMTP, HELO handshake, IPv6-mapped
/r/3/49  - SMTP, HELO handshake, native IPv6
/r/3/50  - SMTP, HELO handshake, userinfo
/r/3/51  - SMTP, HELO handshake, zero
/r/3/52  - SMTP, HELO handshake, zero quad
/r/3/53  - Zabbix, agent.ping passive check
/r/3/54  - Zabbix, agent.ping passive check, 127.x.x.x
/r/3/55  - Zabbix, agent.ping passive check, octal
/r/3/56  - Zabbix, agent.ping passive check, decimal
/r/3/57  - Zabbix, agent.ping passive check, hex
/r/3/58  - Zabbix, agent.ping passive check, Static DNS rebind
/r/3/59  - Zabbix, agent.ping passive check, TOCTOU DNS rebind
/r/3/60  - Zabbix, agent.ping passive check, trailing dot
/r/3/61  - Zabbix, agent.ping passive check, IPv6-mapped
/r/3/62  - Zabbix, agent.ping passive check, native IPv6
/r/3/63  - Zabbix, agent.ping passive check, userinfo
/r/3/64  - Zabbix, agent.ping passive check, zero
/r/3/65  - Zabbix, agent.ping passive check, zero quad
/r/3/66  - Redis, CRLF-smuggled second command
/r/3/67  - Redis, CRLF-smuggled second command, 127.x.x.x
/r/3/68  - Redis, CRLF-smuggled second command, Static DNS rebind
/r/3/69  - Redis, CRLF-smuggled second command, TOCTOU DNS rebind
/r/3/70  - ZooKeeper, CRLF-smuggled second command
/r/3/71  - ZooKeeper, CRLF-smuggled second command, 127.x.x.x
/r/3/72  - ZooKeeper, CRLF-smuggled second command, Static DNS rebind
/r/3/73  - ZooKeeper, CRLF-smuggled second command, TOCTOU DNS rebind
/r/3/74  - Zabbix, CRLF-smuggled second command
/r/3/75  - Zabbix, CRLF-smuggled second command, 127.x.x.x
/r/3/76  - Zabbix, CRLF-smuggled second command, Static DNS rebind
/r/3/77  - Zabbix, CRLF-smuggled second command, TOCTOU DNS rebind

# Protocols (header spray)
/r/3/78  - Redis, INFO command, header spray domain
/r/3/79  - Redis, INFO command, header spray IP
/r/3/80  - Redis, INFO command, 127.x.x.x, header spray domain
/r/3/81  - Redis, INFO command, 127.x.x.x, header spray IP
/r/3/82  - Redis, INFO command, octal, header spray domain
/r/3/83  - Redis, INFO command, octal, header spray IP
/r/3/84  - Redis, INFO command, decimal, header spray domain
/r/3/85  - Redis, INFO command, decimal, header spray IP
/r/3/86  - Redis, INFO command, hex, header spray domain
/r/3/87  - Redis, INFO command, hex, header spray IP
/r/3/88  - Redis, INFO command, Static DNS rebind, header spray domain
/r/3/89  - Redis, INFO command, Static DNS rebind, header spray IP
/r/3/90  - Redis, INFO command, TOCTOU DNS rebind, header spray domain
/r/3/91  - Redis, INFO command, TOCTOU DNS rebind, header spray IP
/r/3/92  - Redis, INFO command, trailing dot, header spray domain
/r/3/93  - Redis, INFO command, trailing dot, header spray IP
/r/3/94  - Redis, INFO command, IPv6-mapped, header spray domain
/r/3/95  - Redis, INFO command, IPv6-mapped, header spray IP
/r/3/96  - Redis, INFO command, native IPv6, header spray domain
/r/3/97  - Redis, INFO command, native IPv6, header spray IP
/r/3/98  - Redis, INFO command, userinfo, header spray domain
/r/3/99  - Redis, INFO command, userinfo, header spray IP
/r/3/100 - Redis, INFO command, zero, header spray domain
/r/3/101 - Redis, INFO command, zero, header spray IP
/r/3/102 - Redis, INFO command, zero quad, header spray domain
/r/3/103 - Redis, INFO command, zero quad, header spray IP
/r/3/104 - Memcached, stats command, header spray domain
/r/3/105 - Memcached, stats command, header spray IP
/r/3/106 - Memcached, stats command, 127.x.x.x, header spray domain
/r/3/107 - Memcached, stats command, 127.x.x.x, header spray IP
/r/3/108 - Memcached, stats command, octal, header spray domain
/r/3/109 - Memcached, stats command, octal, header spray IP
/r/3/110 - Memcached, stats command, decimal, header spray domain
/r/3/111 - Memcached, stats command, decimal, header spray IP
/r/3/112 - Memcached, stats command, hex, header spray domain
/r/3/113 - Memcached, stats command, hex, header spray IP
/r/3/114 - Memcached, stats command, Static DNS rebind, header spray domain
/r/3/115 - Memcached, stats command, Static DNS rebind, header spray IP
/r/3/116 - Memcached, stats command, TOCTOU DNS rebind, header spray domain
/r/3/117 - Memcached, stats command, TOCTOU DNS rebind, header spray IP
/r/3/118 - Memcached, stats command, trailing dot, header spray domain
/r/3/119 - Memcached, stats command, trailing dot, header spray IP
/r/3/120 - Memcached, stats command, IPv6-mapped, header spray domain
/r/3/121 - Memcached, stats command, IPv6-mapped, header spray IP
/r/3/122 - Memcached, stats command, native IPv6, header spray domain
/r/3/123 - Memcached, stats command, native IPv6, header spray IP
/r/3/124 - Memcached, stats command, userinfo, header spray domain
/r/3/125 - Memcached, stats command, userinfo, header spray IP
/r/3/126 - Memcached, stats command, zero, header spray domain
/r/3/127 - Memcached, stats command, zero, header spray IP
/r/3/128 - Memcached, stats command, zero quad, header spray domain
/r/3/129 - Memcached, stats command, zero quad, header spray IP
/r/3/130 - ZooKeeper, ruok four-letter command, header spray domain
/r/3/131 - ZooKeeper, ruok four-letter command, header spray IP
/r/3/132 - ZooKeeper, ruok four-letter command, 127.x.x.x, header spray domain
/r/3/133 - ZooKeeper, ruok four-letter command, 127.x.x.x, header spray IP
/r/3/134 - ZooKeeper, ruok four-letter command, octal, header spray domain
/r/3/135 - ZooKeeper, ruok four-letter command, octal, header spray IP
/r/3/136 - ZooKeeper, ruok four-letter command, decimal, header spray domain
/r/3/137 - ZooKeeper, ruok four-letter command, decimal, header spray IP
/r/3/138 - ZooKeeper, ruok four-letter command, hex, header spray domain
/r/3/139 - ZooKeeper, ruok four-letter command, hex, header spray IP
/r/3/140 - ZooKeeper, ruok four-letter command, Static DNS rebind, header spray domain
/r/3/141 - ZooKeeper, ruok four-letter command, Static DNS rebind, header spray IP
/r/3/142 - ZooKeeper, ruok four-letter command, TOCTOU DNS rebind, header spray domain
/r/3/143 - ZooKeeper, ruok four-letter command, TOCTOU DNS rebind, header spray IP
/r/3/144 - ZooKeeper, ruok four-letter command, trailing dot, header spray domain
/r/3/145 - ZooKeeper, ruok four-letter command, trailing dot, header spray IP
/r/3/146 - ZooKeeper, ruok four-letter command, IPv6-mapped, header spray domain
/r/3/147 - ZooKeeper, ruok four-letter command, IPv6-mapped, header spray IP
/r/3/148 - ZooKeeper, ruok four-letter command, native IPv6, header spray domain
/r/3/149 - ZooKeeper, ruok four-letter command, native IPv6, header spray IP
/r/3/150 - ZooKeeper, ruok four-letter command, userinfo, header spray domain
/r/3/151 - ZooKeeper, ruok four-letter command, userinfo, header spray IP
/r/3/152 - ZooKeeper, ruok four-letter command, zero, header spray domain
/r/3/153 - ZooKeeper, ruok four-letter command, zero, header spray IP
/r/3/154 - ZooKeeper, ruok four-letter command, zero quad, header spray domain
/r/3/155 - ZooKeeper, ruok four-letter command, zero quad, header spray IP
/r/3/156 - SMTP, HELO handshake, header spray domain
/r/3/157 - SMTP, HELO handshake, header spray IP
/r/3/158 - SMTP, HELO handshake, 127.x.x.x, header spray domain
/r/3/159 - SMTP, HELO handshake, 127.x.x.x, header spray IP
/r/3/160 - SMTP, HELO handshake, octal, header spray domain
/r/3/161 - SMTP, HELO handshake, octal, header spray IP
/r/3/162 - SMTP, HELO handshake, decimal, header spray domain
/r/3/163 - SMTP, HELO handshake, decimal, header spray IP
/r/3/164 - SMTP, HELO handshake, hex, header spray domain
/r/3/165 - SMTP, HELO handshake, hex, header spray IP
/r/3/166 - SMTP, HELO handshake, Static DNS rebind, header spray domain
/r/3/167 - SMTP, HELO handshake, Static DNS rebind, header spray IP
/r/3/168 - SMTP, HELO handshake, TOCTOU DNS rebind, header spray domain
/r/3/169 - SMTP, HELO handshake, TOCTOU DNS rebind, header spray IP
/r/3/170 - SMTP, HELO handshake, trailing dot, header spray domain
/r/3/171 - SMTP, HELO handshake, trailing dot, header spray IP
/r/3/172 - SMTP, HELO handshake, IPv6-mapped, header spray domain
/r/3/173 - SMTP, HELO handshake, IPv6-mapped, header spray IP
/r/3/174 - SMTP, HELO handshake, native IPv6, header spray domain
/r/3/175 - SMTP, HELO handshake, native IPv6, header spray IP
/r/3/176 - SMTP, HELO handshake, userinfo, header spray domain
/r/3/177 - SMTP, HELO handshake, userinfo, header spray IP
/r/3/178 - SMTP, HELO handshake, zero, header spray domain
/r/3/179 - SMTP, HELO handshake, zero, header spray IP
/r/3/180 - SMTP, HELO handshake, zero quad, header spray domain
/r/3/181 - SMTP, HELO handshake, zero quad, header spray IP
/r/3/182 - Zabbix, agent.ping passive check, header spray domain
/r/3/183 - Zabbix, agent.ping passive check, header spray IP
/r/3/184 - Zabbix, agent.ping passive check, 127.x.x.x, header spray domain
/r/3/185 - Zabbix, agent.ping passive check, 127.x.x.x, header spray IP
/r/3/186 - Zabbix, agent.ping passive check, octal, header spray domain
/r/3/187 - Zabbix, agent.ping passive check, octal, header spray IP
/r/3/188 - Zabbix, agent.ping passive check, decimal, header spray domain
/r/3/189 - Zabbix, agent.ping passive check, decimal, header spray IP
/r/3/190 - Zabbix, agent.ping passive check, hex, header spray domain
/r/3/191 - Zabbix, agent.ping passive check, hex, header spray IP
/r/3/192 - Zabbix, agent.ping passive check, Static DNS rebind, header spray domain
/r/3/193 - Zabbix, agent.ping passive check, Static DNS rebind, header spray IP
/r/3/194 - Zabbix, agent.ping passive check, TOCTOU DNS rebind, header spray domain
/r/3/195 - Zabbix, agent.ping passive check, TOCTOU DNS rebind, header spray IP
/r/3/196 - Zabbix, agent.ping passive check, trailing dot, header spray domain
/r/3/197 - Zabbix, agent.ping passive check, trailing dot, header spray IP
/r/3/198 - Zabbix, agent.ping passive check, IPv6-mapped, header spray domain
/r/3/199 - Zabbix, agent.ping passive check, IPv6-mapped, header spray IP
/r/3/200 - Zabbix, agent.ping passive check, native IPv6, header spray domain
/r/3/201 - Zabbix, agent.ping passive check, native IPv6, header spray IP
/r/3/202 - Zabbix, agent.ping passive check, userinfo, header spray domain
/r/3/203 - Zabbix, agent.ping passive check, userinfo, header spray IP
/r/3/204 - Zabbix, agent.ping passive check, zero, header spray domain
/r/3/205 - Zabbix, agent.ping passive check, zero, header spray IP
/r/3/206 - Zabbix, agent.ping passive check, zero quad, header spray domain
/r/3/207 - Zabbix, agent.ping passive check, zero quad, header spray IP
/r/3/208 - Redis, CRLF-smuggled second command, header spray domain
/r/3/209 - Redis, CRLF-smuggled second command, header spray IP
/r/3/210 - Redis, CRLF-smuggled second command, 127.x.x.x, header spray domain
/r/3/211 - Redis, CRLF-smuggled second command, 127.x.x.x, header spray IP
/r/3/212 - Redis, CRLF-smuggled second command, Static DNS rebind, header spray domain
/r/3/213 - Redis, CRLF-smuggled second command, Static DNS rebind, header spray IP
/r/3/214 - Redis, CRLF-smuggled second command, TOCTOU DNS rebind, header spray domain
/r/3/215 - Redis, CRLF-smuggled second command, TOCTOU DNS rebind, header spray IP
/r/3/216 - ZooKeeper, CRLF-smuggled second command, header spray domain
/r/3/217 - ZooKeeper, CRLF-smuggled second command, header spray IP
/r/3/218 - ZooKeeper, CRLF-smuggled second command, 127.x.x.x, header spray domain
/r/3/219 - ZooKeeper, CRLF-smuggled second command, 127.x.x.x, header spray IP
/r/3/220 - ZooKeeper, CRLF-smuggled second command, Static DNS rebind, header spray domain
/r/3/221 - ZooKeeper, CRLF-smuggled second command, Static DNS rebind, header spray IP
/r/3/222 - ZooKeeper, CRLF-smuggled second command, TOCTOU DNS rebind, header spray domain
/r/3/223 - ZooKeeper, CRLF-smuggled second command, TOCTOU DNS rebind, header spray IP
/r/3/224 - Zabbix, CRLF-smuggled second command, header spray domain
/r/3/225 - Zabbix, CRLF-smuggled second command, header spray IP
/r/3/226 - Zabbix, CRLF-smuggled second command, 127.x.x.x, header spray domain
/r/3/227 - Zabbix, CRLF-smuggled second command, 127.x.x.x, header spray IP
/r/3/228 - Zabbix, CRLF-smuggled second command, Static DNS rebind, header spray domain
/r/3/229 - Zabbix, CRLF-smuggled second command, Static DNS rebind, header spray IP
/r/3/230 - Zabbix, CRLF-smuggled second command, TOCTOU DNS rebind, header spray domain
/r/3/231 - Zabbix, CRLF-smuggled second command, TOCTOU DNS rebind, header spray IP

----

Buckets 0-2 redirect through 3 hops (this domain twice, then the real
target) to defeat filters that only inspect one redirect. Bucket 3 uses
1 hop instead, since curl and most HTTP clients only auto-follow
redirects to http/https/ftp/ftps by default, chaining through
gopher:// or dict:// would break the final hop.

Localhost & Internal (0): no fixed response shape, grep for whatever
you expect from the target. Six sub-targets: bare IP, server-status,
server-info, actuator/health, phpMyAdmin, admin. Every entry also gets
two header spray siblings: spray domain and spray IP across Host,
X-Forwarded-For, X-Real-IP, True-Client-IP, X-Client-IP and
X-Originating-IP, betting the app copies one through or trusts it.

Cloud Metadata (1): deterministic content when reachable. Double
slashes slip past poor regex filters. GCP and Azure require a
specific header (Metadata-Flavor, Metadata) to respond; our redirect
includes it, but whether it survives to the target's own request
depends on the vulnerable app.

Local File Read (2): bypasses URL validation that only checks for a
query string. Covers three input sinks: shell execution, direct file
read, and file-fetch functions. From our own SSRF research. Grep for
root:x:0:0.

Internal Protocols (3): injects raw commands into non-HTTP services
via gopher:// and dict://. Some entries chain a second command using
CRLF in the gopher selector.

Userinfo entries resolve TARGET at request time: Referer host, then
your observed IP, then Google.com to not leave it empty.

This page includes a hidden MAX count per category in its HTML
source, useful for scripting a full loop instead of copying links
one by one. Example one-liner and usage: this.

DISCLAIMER: we only redirect. Your target's request goes straight to
the real endpoint, never through us. Access logs still record the
payload number and your IP, same as any web request.

For more on SSRF, check this.


© 2026 Brute Logic - All rights reserved.