Web Hacking for Pentesters: Server-Side Request Forgery (SSRF)

Overview

SSRF happens when an application fetches a URL or network resource based on attacker-influenced input, and the server’s network position is more trusted than the caller’s.

Impact ranges from internal port scanning signals to access to cloud metadata services or admin panels—depending on architecture and egress controls.

What You Will Learn

• Spot features that fetch remote resources

• Distinguish classic vs blind SSRF evidence

• Explain filter bypass classes without dumping exploit kits

• Recommend allow-lists and egress proxies

Features That Often Fetch URLs

• Webhook testers and callback validators

• Link preview / unfurl generators

• PDF and document converters

• Import-from-URL and avatar fetch

• SSO/metadata loaders and internal gateway “proxy” helpers

What Reviewers Care About

Can the server reach private ranges, link-local addresses, or cloud metadata endpoints?

Are HTTP redirects followed to a destination that bypasses the first allow-list check?

Is response body returned to the attacker (classic) or only side effects observable (blind)?

Does DNS resolution happen before or after policy checks?

Authorized Testing Notes

Stay inside written scope. Proving reachability to an agreed internal canary is better than noisy scanning.

Document the feature, parameter, and trust boundary clearly for triage.

Avoid using customer infrastructure to attack third parties.

Remediation

Allow-list destinations by service identity, not free-form user hosts.

Resolve DNS and block private/link-local ranges on the final address.

Disable unnecessary redirect following.

Push URL fetching through a locked-down egress proxy with logging.

Conclusion

Use these techniques only on systems you are authorized to assess. SapiensHack focuses on practical methodology, clear evidence, and fixes teams can ship.

Related Reading

• Web Hacking for Pentesters: XXE Attacks

• Penetration Testing: Web Application Checklist (WAPT)

• Start Here: SapiensHack Learning Path