Exploiting SSRF

SSRF matters because of what the server can reach that you cannot: the cloud metadata endpoint holding role credentials, internal services with no authentication, and the container network. The vulnerability is trivial; the work is in the bypasses and in knowing which internal target converts a curiosity into a compromise.

Only against systems you are authorized to test.

When to Use

• Any feature that fetches a URL: webhooks, imports, avatar-from-URL, link previews, PDF/screenshot generation, XML/SVG processing, file fetch by URI
• A parameter contains a URL, hostname, IP, or a path that becomes one
• Source review finds an outbound HTTP call with a user-influenced target
• Testing an integration that "calls back" to a customer-supplied endpoint

When NOT to Use