SSRF Hunting

Locate every place the server fetches a URL you control, then test it methodically.

Where to Look

• Webhooks and callback URLs (payments, integrations, alerts)
• Importers: avatar-by-URL, import-from-URL, RSS feed readers
• Preview generators: link unfurlers, PDF/image renderers, screenshot services
• File parsers that resolve external entities or references (XInclude, XSLT, SVG)
• Proxy/redirect endpoints taking a url= parameter

Test Matrix

Basic

• http://127.0.0.1:PORT for internal services (find live ports via response differential)
• http://localhost, http://[::1], http://2130706433 (integer IP), http://0x7f000001
• Internal hostnames: http://inventory, http://kubernetes.default.svc