Web Hacking for Pentesters: Server-Side Request Forgery (SSRF)

SSRF is the server doing HTTP on your behalf—often with nicer network seats than you have. PDF fetchers, webhooks, import-from-URL, and preview features are classic.

Cloud metadata endpoints made SSRF famous; internal admin panels on RFC1918 space still show up constantly.

SSRF stories almost always involve a feature that fetches URLs because product wanted previews or webhooks—start reviews by listing every server-side fetcher.

Discovery hints

Parameters named url, link, src, destination, webhook. Out-of-band callbacks when inline responses are blind—use approved collaborator infrastructure only.

Check redirect following and protocol handlers conceptually without reckless scanning.

Impact tiers

Internal port scan signals, reading internal apps, cloud credential exposure, and chaining to RCE via internal services.

• Document which network position the server occupies

• Redact sensitive internal responses in reports

• Recommend network egress filtering

Defensive notes

Allowlist destinations, block link-local and metadata IPs, disable unnecessary URL fetch features.

SSRF testing can touch internal systems—get explicit ROE.

Don't pivot into internal networks beyond signed scope.

Close SSRF tickets with egress recommendations, not only parameter blocklists—network controls outlive individual bug fixes.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

List every import-by-URL feature in notes—even disabled ones return after launches.

Blind confirmation

When responses don't show internal data, approved OOB callbacks may still prove reachability—note exactly what was allowed in scope.

Document whether the fetch follows redirects to internal hosts—that's a separate misconfiguration from the initial parameter.

Cloud nuance

Metadata endpoints differ by cloud and hardening level—describe which environment you tested.

Internal SSRF to HTTPS services with bad certs may fail silently—note error handling.

Recommend egress proxies with default-deny for server-side fetchers.

---

Worth reading next

Open Redirects: Small Bugs, Bigger Chains

Network Hacking: From Perimeter to Application

API Hacking: Rate Limiting and Resource Consumption