---
name: ssrf-oast-evidence
description: Prove or reject an authorized server-side fetch using unique callback correlation, protocol controls, and minimal evidence.
---

# SSRF and OAST evidence

## Accepted inputs

- Current scope and explicit callback-testing permission
- The suspected URL consumer, controlled request reference, and callback service
- Allowed schemes, redirect rules, and prohibited destinations

## Procedure

1. Assign a unique callback identifier to one sink and one attempt.
2. Establish browser-only and unused-identifier negative controls.
3. Submit a harmless HTTPS callback and record DNS and HTTP timing, headers, method, and correlation.
4. Distinguish server fetch, client fetch, scanner preview, mail gateway, and security middleware.
5. If permitted, change one property such as redirect, port, scheme, or response profile.
6. Preserve only bounded redacted callback evidence and request references.

## Output artifacts

- Callback plan and correlation table
- Positive and negative event references
- Supported fetch capability and untested escalation edges

## Stop conditions

Do not access internal data, cloud credentials, link-local services, or any destination prohibited by the program.

## Completion gate

Complete when a unique event reliably ties the authorized sink to a server-side request and controls reject cheaper explanations, or the lead is rejected after bounded attempts.