SSRF
Canary first. Metadata second. File handlers last.
Tags: ssrf, cloud
Checklist
- Find the fetchers — Unfurl, PDF, image proxy, webhook, SVG, Markdown, OOXML, link-check, antivirus cloud.
- Canary — OAST HTTP/DNS. Prove the server made the request before you talk about impact.
- Redirects and DNS — 302 to internal, rebinding, nip.io, localhost aliases.
- Parser tricks — Decimal IP, octal, IPv6, zone IDs, userinfo @, enclosed dots, https://127.0.0.1.attacker.com.
- Schemes — http/https first. Then file, gopher, dict, ftp only if the library actually speaks them.
- Cloud metadata — IMDSv1 vs v2. GCP, Azure, metadata.google.internal. Header-required IMDS is not 'safe', it is a harder gadget.
- Second-order — URL stored, fetched later by a worker, or fetched as the victim.