SSRF
Server-Side Request Forgery (SSRF) is attackers inducing the server to make requests to intranet/metadata services, accessing internal resources that should not be exposed.
Purpose
To understand SSRF caused by controllable server-side HTTP requests and its defenses; a high-risk vulnerability in cloud environments.
Mechanism
The program fetches a user-specified URL via fetch(user_url); the attacker supplies http://169.254.169.254/ so the server requests the cloud metadata endpoint and leaks credentials. Defenses: URL whitelists, intranet blocking, response filtering.
Use cases
- Cloud metadata leakage
- Intranet probing defense
- Server-side request security
Related tools
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side. TOOL
HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side. TOOL