What is SSRF?
An attack that makes a server send requests on the attacker’s behalf — often to internal services or cloud metadata, where it can steal credentials.
SSRF: An attack that makes a server send requests on the attacker’s behalf — often to internal services or cloud metadata, where it can steal credentials.
In plain language
SSRF turns a server feature that fetches a URL — a webhook, an image proxy, a PDF renderer — into a weapon that reaches places the attacker cannot: internal admin panels, the cloud metadata endpoint, databases behind the firewall. In cloud environments it is a classic first step to full account takeover.
SuperPentest tests SSRF including the blind cases, using out-of-band interaction to prove the server really made the request, then reproduces it. See SSRF testing.
A concrete example
An “import from URL” feature fetches whatever address you give it. An attacker supplies http://169.254.169.254/latest/meta-data/, and the server dutifully returns cloud credentials from its metadata endpoint — a direct path to the account. Even when nothing is echoed back, an out-of-band callback proves the server made the request. That is how SuperPentest confirms blind SSRF safely.
Related
SSRF testing → · How findings are verified →
Want this tested on your app? Book a demo or read how findings are verified.