Fetch features first. Probe gently. Never DoS.

0:00–0:15 Fetch-feature inventory model + response types

List import/webhook/PDF/avatar/fetch + full/partial/blind responses. Read PortSwigger SSRF topic § basic vs blind ONLY.

0:15–1:05 Localhost → blind OOB labs + THM ssrfhr (lab)

Do PortSwigger SSRF 7 labs (localhost → 192.168 backends → blacklist/whitelist bypass → blind OOB) IN ORDER + THM ssrfhr Task 1–5 (intro/impact/locations/blind/practical) ONLY. Blind via Collaborator, baseline first.

1:05–2:00 Slack [::] $100 + Evernote metadata patterns

Read Slack [::] blacklist-bypass $100 summary + H1 #264671 Evernote (stockApi= + 2130706433/127.1 bypass + token order) — bypass + order ONLY + H1 #341876 ImageMagick SSRF (file-format fetch + Collaborator) — sink ONLY.

2:00–2:35 Bypass table: encode/octal/IPv6/0.0.0.0/@/#/redirect

Consolidate per PATT SSRF blacklist + whitelist-via-@/ # rows + HackTricks cloud-metadata endpoints ONLY.

2:35–3:00 Bypass-types test + gaps

Recite 5 bypass families cold. Triage gaps (metadata next).

0:00–0:15 IMDSv1 vs v2 + ECS/GCP/Azure variants

Write GET /latest/meta-data/iam/security-credentials/ vs PUT /latest/api/token hop. Read AWS IMDS retrieval + IMDSv2 configuration § token TTL ONLY.

0:15–1:05 IMDSv1 creds → role + v2 token hop (lab only)

On LAB SSRF: fetch role-name → creds JSON (lab), then PUT token + X-aws-ec2-metadata-token header hop (lab). Note ECS task-role + GCP/Azure header variants per HackTricks cloud-metadata endpoints ONLY. If v2 enforced → STOP takeover, pivot to internal HTTP scan theory.

1:05–2:00 SSRF→IAM→s3-ls chain + task-role pivot

Read 1 metadata-takeover chain (role creds → aws s3 ls read-only) + 1 ECS task-role pivot — credential-handling + stop point ONLY. X: SSRF IMDS bugbounty lang:en min_faves:50.

2:00–2:35 Cred-handling + stop-and-report card

Write card: redact keys, no privilege use beyond role-name + s3 ls, 24h report. Reference OWASP SSRF prevention sheet § remediation quote ONLY.

2:35–3:00 IMDSv2-diff test + gaps

Explain v2 token defense + bypass condition (PUT allowed?). Triage gaps.

0:00–0:15 Bypass primitives: // \\ %2f %5c pollution

List scheme-relative/backslash/encoding/param-pollution. Read PortSwigger open-redirect § bypass rows ONLY.

0:15–1:05 30+ bypass matrix (lab)

Build matrix per PATT Open Redirect 30+ rows (//, \\, %2f, %5c, @, #, ?next=) ONLY on lab ?next=/, ?redirect=, ?returnUrl=. Note 301/302 (downgrade POST→GET) vs 307/308 (preserve) split.

1:05–2:00 Redirect→OAuth-theft + SSRF-aid + 307/308 method chain

Chain on lab: redirect → OAuth redirect_uri mismatch → code theft (Week 04 bridge) + redirect → SSRF filter aid (//evil%2f..). Read hacktivity open redirect OAuth takeover 1 report — chained param ONLY.

2:00–2:35 Redirect matrix + chain templates

Consolidate + write OAuth-theft + SSRF-aid templates (param → bypass → impact).

2:35–3:00 Pay-vs-alone test + gaps

Judge 3 redirects (alone vs chained). Triage gaps.

0:00–0:15 Host trust points: reset links, cache keys, routing

List 3 trust points. Read PortSwigger host-header topic § reset-poisoning ONLY.

0:15–1:05 Reset-poisoning labs + cache-key Host variants (lab)

Do PortSwigger host-header 5 labs (password-reset poisoning ATO incl.) IN ORDER. Test Host: evil + X-Forwarded-Host + cache-key variants. THM httpin137minutes Task 8 (Host/Cache headers) ONLY.

1:05–2:00 CRLF header-split + log→admin XSS/SQL

Test %0d%0aSet-Cookie split → fixation/XSS per PATT CRLF rows ONLY (lab) + log injection (\n[admin]) → admin-panel XSS/SQL theory (no prod log writes). Read HackTricks CRLF § log-sink rows ONLY.

2:00–2:35 Host + CRLF matrices + log-sink list

Consolidate 2 matrices + sinks (auth logs, error logs, analytics).

2:35–3:00 Host-impact test + gaps

Summarize 3 impacts (ATO/cache/route). Triage gaps.

0:00–0:15 CL.TE vs TE.CL vs H2-downgrade vs TE.0 shapes

Draw 4 shapes. Read PortSwigger smuggling topic § CL.TE/TE.CL defs ONLY + Kettle Must-Die § TE.0 + H2.CL rows ONLY.

0:15–1:05 Smuggler probe + Turbo confirm on lab (timing only)

Run smuggler.py -u lab -m POST -x -q -l smug.log -c default.py probe ONLY + Turbo single-packet DesyncAttack_CLTE/TECL on LAB ONLY (timing differential, no exploit). Smuggler DOCUMENT.md § detection probes ONLY. YT: HTTP request smuggling CL.TE TE.CL James Kettle.

1:05–2:00 Desync cred-hijack paper + TE.0 CDN case (read, no replay)

Read Kettle Must-Die § cred-hijack flow + mitigation table ONLY + 1 TE.0 CDN report summary — variant shape ONLY. Note H2 rapid-reset as DoS class (recognize, never test live).

2:00–2:35 Probe log + false-positive checks

Log probe → confirm → FP checks (retry, connection reuse, timeout vs desync). Reference Turbo tiscripts gate comments ONLY.

2:35–3:00 CL.TE vs TE.CL test + gaps

Explain with header pairs. Triage gaps (cache next).

0:00–0:15 Key vs unkeyed + Vary + deception paths

Define keyed (Host/URI) vs unkeyed (X-Forwarded-Host/UTM/UA) + Vary + /profile/.json confusion. Read PortSwigger cache-poisoning § unkeyed ONLY + deception § path-confusion ONLY.

0:15–1:05 Unkeyed header/param labs + Vary check (lab)

Do PortSwigger cache labs (unkeyed header/param) IN ORDER. Check Vary + cache headers (Age/X-Cache/Hit-Miss). YT: web cache poisoning deception XSS. X: cache deception PII bounty.

1:05–2:00 Cache→XSS hijack + deception PII-leak cases

Read 1 cache→XSS (unkeyed header reflected into cached JS) + 1 deception (/profile.css-style → PII cache) — key + payload + victim impact ONLY.

2:00–2:35 Key map + deception path list (lab)

Map keys + list .css/.json/.ico-suffixed authed paths. No cache-busting floods, no victim poisoning on live.

2:35–3:00 Unkeyed test + gaps

Explain unkeyed with lab example. Triage gaps (live hunt next).

0:00–0:15 Fetch + redirect + Host inventory recall

List every fetch/import/export/preview/webhook + redirect/next/returnUrl + Host reflection from your map. Check WSTG SSRF § objectives ONLY.

0:15–1:05 URL-fetch + redirect + Host safe probes (VDP, gentle)

Probe each fetch/redirect/Host with Collaborator/canary + 301/302/307/308 split note, ONE request each. No IMDS beyond role-name (and only if prior SSRF proof), no smuggle/cache exploit on live.

1:05–2:00 Same-program SSRF disclosures (2)

Read H1 hacktivity same-program SSRF 2 — fetch-param + bypass ONLY. Compare your inventory gaps.

2:00–2:35 SSRF playbook update + minimal proofs (redacted)

Update playbook (fetch→bypass→OOB→internal→role-name). Archive minimal proofs. No cache/smuggle exploit artifacts on live.

2:35–3:00 SSRF triage + no-DoS test + gaps to Week 09

Recite triage + no-DoS rule. Assign gaps (upload/parser sinks) to Week 09.