SSRF Double-Slash Absolute Path Bypass via GitHub Blob URL (Red Agent)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•10

Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.