Ssrf
From a single URL parameter to the entire cloud metadata service. Understand how server-side request forgery turns the server into a proxy for internal attacks.
Curriculum
8 parts in 5 phasesSSRF: The Server Makes the Request
The app fetches a URL the attacker controls. Now the server issues GET requests on behalf of the attacker — to internal IPs, cloud metadata, and services that trust localhost.
Finding SSRF in the Wild
URL params, webhook URLs, file imports, document preview, SSO SAML assertions — every place the server fetches a URI the attacker controls.
Cloud Metadata Attacks
AWS IMDS, Azure IMDS, GCP metadata. The one URL that returns cloud credentials, access tokens, and infrastructure secrets — accessible from any compute instance.
Internal Network Pivot
From the vulnerable app server to every internal service. Redis, Elasticsearch, internal dashboards, Kubernetes API — that the attacker cannot reach directly but the server can.
Blind SSRF
No response body, no error message — only a side-channel pingback. Blind SSRF detection via out-of-band DNS/HTTP callbacks, timing, and error-based inference.