SSRF Detection

When to Use

Audit webhook handlers, URL preview generators, import-from-URL features, image proxy endpoints, PDF generators that fetch remote resources, and any endpoint that makes HTTP requests based on user-supplied URLs.

Process

Step 1: Find HTTP Request Sinks

# JavaScript
grep -rn "fetch(\|axios\|got(\|node-fetch\|http\.get\|https\.get\|request(" .
grep -rn "urllib\|url\.parse\|new URL(" .

# Python
grep -rn "requests\.get\|requests\.post\|urllib\.request\|urlopen\|httpx" .