SSRF
Canary first. Metadata second. File handlers last.
Tags: ssrf, cloud
Checklist
- Find the fetchers: Unfurl, PDF, image proxy, webhook, SVG, Markdown, OOXML, link-check, antivirus cloud.
- Canary: OAST HTTP/DNS. Prove the server made the request before you talk about impact.
- Redirects and DNS: 302 to internal, rebinding, nip.io, localhost aliases.
- Parser tricks: Decimal IP, octal, IPv6, zone IDs, userinfo @, enclosed dots, https://127.0.0.1.attacker.com.
- Schemes: http/https first. Then file, gopher, dict, ftp only if the library actually speaks them.
- Cloud metadata: IMDSv1 vs v2. GCP, Azure, metadata.google.internal. Header-required IMDS is not 'safe', it is a harder gadget.
- Second-order: URL stored, fetched later by a worker, or fetched as the victim.