vulns.co
/
GKData.io MCP

Back to Payloads

URL consumer probes

Map which product features consume a URL: previews, imports, avatars, webhooks, PDFs, and feeds. Start with an owned HTTPS endpoint that returns a small, benign response.

Tags: url, ssrf, oast, recon

Controlled probes

  • https://UNIQUE-CALLBACK.example/consumer/image-001
  • https://UNIQUE-CALLBACK.example/consumer/redirect-001
  • Compare immediate fetches with delayed worker or queue callbacks

Source: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery