Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

SSRF

Server-side request forgery turns a trusted server into a request-making proxy for the attacker, reaching internal services and cloud credentials the internet should never touch. Here is how it works and how to lock it down.

4 articles 18 min total Overview to advanced techniques

Start with the overview

SSRF3 min read

SSRF, Explained: When Your Server Becomes the Attacker's Proxy

Server-side request forgery turns a trusted server into a request-making proxy for the attacker, reaching internal services and cloud credentials the internet should never touch. Here is how it works and how to lock it down.

Read the overview

SSRF techniques

3 focused deep-dives
  1. 02 BlindBlind and Out-of-Band SSRF: Detecting the Request You Can't See 5 min
  2. 03 Cloud MetadataCloud-Metadata SSRF: From One URL to Full Account Takeover 5 min
  3. 04 Protocol SmugglingProtocol Smuggling in SSRF: gopher, dict and file Schemes 5 min