Web SecurityHighBlind SSRFRead SSRF

Server-Side Request Forgery (SSRF)

The server fetches an attacker-controlled URL, enabling internal network access, cloud metadata theft, and request forgery.

Live Playground · Powered by this research

SSRF Target Checker

Try:

Payloads from this research (10 total)

http://169.254.169.254/latest/meta-data/iam/security-credentials/

http://metadata.google.internal/computeMetadata/v1/?recursive=true&alt=json

http://100.100.100.200/latest/meta-data/ (Alibaba)

http://[::ffff:a9fe:a9fe]  (IPv6-mapped 169.254.169.254)

These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

Features that fetch a URL - webhooks, link previews, image/avatar fetchers, PDF/screenshot renderers, document import - can be pointed at internal services or cloud metadata (169.254.169.254). Allowlists are bypassed with DNS rebinding, redirects, decimal/octal/IPv6 IPs, and alternate schemes.

How it works

Example

http

POST /api/webhook
{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}

Impact

Cloud IAM credential theft, internal port scanning and pivoting, reading local files via file://, and protocol smuggling via gopher://.

Detection

Inject per-target unique out-of-band (OAST) URLs into URL-shaped parameters and correlate DNS/HTTP callbacks; on a hit, probe cloud metadata endpoints and grade by what reflects.

Prevention

Resolve and validate the destination IP, blocking RFC1918, link-local and metadata ranges - re-validate after redirects.
Use an allowlist of permitted hosts/schemes; deny by default.
Disable unused URL schemes (file, gopher, dict) in the fetch client.
Enforce IMDSv2 and network egress controls on cloud hosts.

Real-world HackerOne reports

Sampled from 207 disclosed reports analyzed for the Server-Side Request Forgery (SSRF) research playbook.

#1004847 #1006599 #1018568 #1023920 #1049624 #1055823 #1057531 #1062888