exploiting-server-side-request-forgery

Identify features that fetch user-supplied URLs such as webhooks, URL previews, and file imports, then replace the URL with a Burp Collaborator or interactsh payload. An incoming out-of-band interaction confirms the server makes requests to attacker-controlled destinations.

Submit the URL http://169.254.169.254/latest/meta-data/ through the vulnerable parameter, then request the IAM security-credentials path to retrieve temporary access keys. Note that IMDSv2 requires a session token header, which mitigates basic SSRF.

Burp Suite Professional with Collaborator handles request modification and blind SSRF detection, interactsh provides open-source out-of-band interaction detection, and SSRFmap automates exploitation with protocol support. curl is used for manual payload testing.

Use IP encoding variants such as octal, hexadecimal, decimal, or short-form addresses, URL parsing tricks like embedded credentials, and alternate protocols such as gopher, file, and dict. DNS rebinding services like rbndr.us alternate DNS responses to defeat hostname allowlists.

Blind SSRF occurs when the server makes the request but does not return the response content to the tester. It is detected through out-of-band interaction servers or time-based analysis comparing response times for open versus closed internal ports.

SSRF testing requires a written penetration testing agreement that explicitly includes SSRF in scope. Without documented authorization, probing internal networks and cloud metadata endpoints is unauthorized access and should not be attempted.