Webhooks, Unfurl, PDF, Image SSRF

Tags: ssrf, webhook, pdf, cloud

Level: advanced

Method

1. Inventory fetchers

   Webhooks, link preview, OG scraper, PDF export, image resize, antivirus, Slack-style unfurl, Markdown images.

   Tools: jsluice, Burp Suite

2. Canary

   Unique OAST URL. Prove the server fetched it (User-Agent, source IP, DNS).

   Tools: interactsh

3. Follow the parser

   Redirects, DNS rebinding, decimal IPs, IPv6, URL allowlists that use regex on the first hop only.

4. Impact

   Internal admin, cloud metadata, file:// of app config. Stop at proof. No customer data.

Field notes

• Headless Chrome PDF printers will often hit file:// or internal HTTP if you inject an iframe in the HTML you asked them to print.
• IMDSv2 is a header gadget, not a dead end.

References

• https://portswigger.net/web-security/ssrf