Web Application Hacking (Hands-On)
Server-Side Request Forgery (SSRF) — Concept + Live Lab
Make the server make requests for you — into its own internal network.
Open the interactive lesson & lab →
SSRF tricks a server into making HTTP requests to a destination you choose. Because the request comes from the server, it can reach internal-only systems that you can't touch directly — internal admin panels, databases, and cloud metadata services.
Any feature that fetches a URL is a candidate: link previews, webhooks, PDF generators, image importers, 'import from URL'.
Prime SSRF targets
- http://169.254.169.254/ — the cloud metadata endpoint (AWS/GCP/Azure). Often leaks temporary cloud credentials — a critical finding.
- http://localhost/ and http://127.0.0.1/ — internal admin/health services.
- Internal RFC1918 ranges — 10.x, 172.16-31.x, 192.168.x.
- Alternate schemes — file://, gopher://, dict:// on some parsers.