🎭

SSRF: Server-Side Request Forgery

Medium

Free preview · 2 of 5 steps

SSRF: turning the server into your proxy

Server-Side Request Forgery exploits application features that make outbound HTTP requests. The attacker doesn't call internal services directly — they trick the server into doing it.

This bypasses all network-level protections: the server has internal network access, firewall rules allow its traffic, and it can reach metadata endpoints and internal APIs that are completely blocked from the internet.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step