ssrf-hunter

Identify features that fetch user-supplied URLs such as webhooks, importers, and link previews, then point them at a unique out-of-band collector subdomain. SSRF is confirmed only when your collector records a request from the target's egress IP or the response returns internal-only bytes.

Burp Collaborator is the primary option, with interactsh as the fallback and default when using Caido, which lacks a Collaborator equivalent. Self-hosted DNS/HTTP callback servers or pipedream and webhook.site offer progressively less control.

Test redirect chains from allowlisted hosts, DNS rebinding where validation and fetch resolve differently, alternate IP representations like decimal, hex, or IPv6, and parser confusion between the validating URL parser and the fetching client.

Yes, but only prove reach with a read-only request and redact results; never pull real credentials from iam/security-credentials. Note that AWS IMDSv2 requires a token via PUT, so a failing plain GET is a control, not a finding.

A reflected or accepted url parameter shows only that input was received, not that the server made a request. Without an out-of-band collector hit or internal-only response bytes, there is no receiver oracle and the finding is theoretical.

Stop at proof-of-reach: one or two redacted samples confirming internal or metadata access. Never port-scan internal ranges at volume, exfiltrate live credentials, or claim RCE without a demonstrated chain.