<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: finding-ssrf-vulnerabilities
description: >-
  Discover and exploit Server-Side Request Forgery to access internal services and cloud metadata.
domain: cybersecurity
subdomain: bug-bounty
tags:
  - ssrf
  - server-side
  - cloud-metadata
  - bug-bounty
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Finding SSRF Vulnerabilities

## Overview

Discover and exploit Server-Side Request Forgery to access internal services and cloud metadata.

## Prerequisites

| Requirement | Install |
|---|---|
| Burp Suite | Request interception |
| interactsh | OOB detection |
| Python 3.10+ | For agent tooling |

## Key Concepts

SSRF makes server requests to internal resources. Targets: cloud
metadata (169.254.169.254), internal APIs, file:// handlers.
Bypass via DNS rebinding, URL parsing, redirect chains.

## Quick Reference

```bash
curl 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/'
node agent.js test --url https://target.com/fetch --param url
node agent.js bypass --url https://target.com/fetch --technique dns-rebind
node agent.js scan --endpoints endpoints.txt --payloads ssrf.txt
```

## Workflow

1. Identify URL-fetching
2. Test internal IPs
3. Test protocol handlers
4. Filter bypass
5. OOB detection
6. DNS rebinding
7. Document impact

## Verification

- Verify payloads reach targets
- Confirm OOB callbacks
- Validate bypass techniques
- Check metadata tested
- Verify impact documented

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
