exploiting-server-side-request-forgery

name	exploiting-server-side-request-forgery
description	Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests. Use when working with exploiting server side request forgery.
domain	cybersecurity
tags	["penetration-testing","ssrf","owasp","cloud-security","web-security","burpsuite"]
subdomain	web-application-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Exploiting Server Side Request Forgery

Overview

Cybersecurity skill for exploiting server side request forgery. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "exploiting server side request forgery"

• "Identifying and exploiting SSRF vulnerabilities to access internal services, clo"

• During authorized penetration tests when the application fetches URLs provided by users (webhooks, URL previews, file imports)

• When testing cloud-hosted applications for access to instance metadata services

• For assessing PDF generators, screenshot services, or any feature that renders external content

• When evaluating microservice architectures for internal service access via SSRF

• During security assessments of APIs that accept URL parameters for data fetching

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Authorization: Written penetration testing agreement including SSRF testing scope
• Burp Suite Professional: With Collaborator for out-of-band detection
• interactsh: Open-source OOB interaction server (go install github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest)
• SSRFmap: Automated SSRF exploitation framework (git clone https://github.com/swisskyrepo/SSRFmap.git)
• curl: For manual SSRF payload testing
• Knowledge of target infrastructure: Cloud provider (AWS, GCP, Azure), internal IP ranges

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}