SSRF (Server-Side Request Forgery) Complete Guide

As the founder of OWASP Indianapolis and someone who’s been tracking SSRF attacks for over 15 years, I’ve watched this vulnerability evolve from a niche attack to one of the most dangerous threats in modern web applications.

SSRF attacks let attackers make your server send requests to internal systems, cloud metadata services, or external targets - essentially turning your trusted server into their attack proxy.

What Makes SSRF So Dangerous

SSRF consistently ranks as a critical vulnerability because it:

• Bypasses network firewalls by originating requests from trusted internal servers
• Accesses internal services that should never be reachable from the internet
• Extracts cloud credentials from metadata services (AWS, Azure, GCP)
• Chains with other vulnerabilities to achieve complete system compromise

SSRF Content Library

🎯 Core SSRF Guides

🐍 Python SSRF Prevention

🛡️ Defense Strategies

SSRF Attack Flow Visualization

SSRF Attack Chain:

1. Attacker Input          2. Server Request         3. Internal Access
┌─────────────────┐       ┌─────────────────┐       ┌─────────────────┐
│  Malicious URL  │  -->  │   Your Server   │  -->  │ Internal System │
│                 │       │                 │       │                 │
│ http://169.254. │       │ requests.get()  │       │ AWS Metadata    │
│ 169.254/latest/ │       │ (no validation) │       │ Database        │
│ meta-data/      │       │                 │       │ File System     │
└─────────────────┘       └─────────────────┘       └─────────────────┘
        ^                          ^                          ^
    User Input              Trusted Server              Critical Data

Cloud Metadata Exploitation:

Attacker → Web App → Cloud Metadata Service → Credentials
   |          |              |                    |
   |          |              |                    v
   |          |              |          AWS Keys, Tokens,
   |          |              |          Service Accounts
   |          |              |
   |          |      169.254.169.254/latest/
   |          |      metadata/iam/security-
   |          |      credentials/role-name
   |          |
   |    Vulnerable Parameter:
   |    ?url=http://169.254.169.254/...
   |
 Crafted Request

SSRF Attack Scenarios I’ve Documented

Based on my research and real-world penetration testing:

1. Cloud Metadata Exploitation

• AWS EC2 metadata service attacks
• Azure Instance Metadata Service (IMDS) bypass
• GCP metadata server credential extraction

2. Internal Network Reconnaissance

• Port scanning internal networks
• Service discovery and enumeration
• Database and file server access

3. Authentication Bypass

• OAuth redirect manipulation
• JWT token theft via callback manipulation
• Session token extraction from internal services

Tools & Resources

My SSRF Testing Tools:

• Custom Python scripts for payload generation
• Burp Suite extensions for automated SSRF testing
• Cloud-specific metadata extraction tools

Industry Resources:

• OWASP SSRF Prevention Cheat Sheet
• PortSwigger SSRF Research

Need SSRF Help?

I provide application security consulting focused on SSRF prevention and testing. Contact me for:

• SSRF vulnerability assessments
• Secure code review for SSRF prevention
• Developer training on SSRF defense
• Custom tool development for SSRF testing

Carl Sampson - OWASP Indianapolis Chapter Founder | 15+ Years Application Security