Web › Module 4 › Lesson 1
SSRF
Server-Side Request Forgery—when your app fetches URLs the attacker chooses, including internal services
Visual · web_developer
SSRF tricks the server into making HTTP requests to targets the attacker picks—often localhost, cloud metadata, or internal admin panels.
Opening
The server becomes the attacker’s proxy
Imagine a “preview URL” feature: you paste https://example.com and the server fetches it for a screenshot. What if you paste http://127.0.0.1:6379 or http://169.254.169.254/latest/meta-data/? The request comes from inside the network—with trust the internet never gets. That is SSRF.
1. How SSRF Happens
Any feature where the server retrieves a user-supplied URL or hostname is a candidate: • Webhooks and URL preview/unfurl • PDF generators fetching remote CSS • Import-from-URL, RSS readers, image proxies • SSO or OAuth misconfigurations that follow redirects The attacker does not connect directly to internal IPs—the vulnerable app does it for them.
2. High-Value Targets
Cloud metadata
169.254.169.254 on AWS/GCP/Azure can leak IAM credentials if IMDS is not hardened.
Internal APIs
http://127.0.0.1:8080/admin with no auth because “only localhost can reach it.”
Other protocols
file://, gopher://, or redis:// if the HTTP client is overly permissive.
3. Example Abuse (Lab Context)
Vulnerable fetch [email protected]("/fetch") def fetch(url: str): return requests.get(url, timeout=5).text # no allowlist # Attacker (authorized lab): /fetch?url=http://127.0.0.1:5000/secret # Or: /fetch?url=http://169.254.169.254/latest/meta-data/
@app.get("/fetch")
def fetch(url: str):
return requests.get(url, timeout=5).text # no allowlist
# Attacker (authorized lab): /fetch?url=http://127.0.0.1:5000/secret
# Or: /fetch?url=http://169.254.169.254/latest/meta-data/Defense layers
Deny private/reserved IP ranges, use an allowlist of domains, disable redirects or validate each hop, require auth on internal services anyway, and block cloud metadata endpoints at the network layer.
Knowledge Check
SSRF means the attacker causes:
Multiple choice
Knowledge Check
True or False: Cloud metadata endpoints are a common SSRF target for credential theft.
True or False
Knowledge Check
A strong SSRF mitigation is:
Multiple choice