Mohammed Aljedani
Back to All Writeups
ResearchMediumMITRE T1190MITRE T1552.005
2 min read2026-08-22

Web Application Reconnaissance & SSRF Testing Methodology

Field notes on discovering hidden parameters, testing Server-Side Request Forgery (SSRF) against internal metadata services, and implementing egress filtering.

#Web Security#SSRF#Burp Suite#eCPPT Prep#AppSec
36 views

Overview Server-Side Request Forgery (SSRF) occurs when a web application fetches a remote resource based on a user-supplied URL without validating the destination. In cloud and containerized environments, SSRF frequently allows attackers to reach internal services or instance metadata endpoints.

Offensive Testing Workflow 1. **Identify URL-fetching parameters**: Look for parameters named `url=`, `webhook=`, `dest=`, `callback=`, `avatar=`, or PDF/image export generators. 2. **Test Out-of-Band (OOB) interactions**: Supply an external listener (e.g., `interactsh` or Burp Collaborator) to confirm whether the backend server initiates HTTP or DNS requests. 3. **Probe loopback and internal ranges**:

bash
# Testing internal loopback & cloud metadata endpoints
curl -i -s "https://target.local/api/fetch?url=http://127.0.0.1:8080/admin"
curl -i -s "https://target.local/api/fetch?url=http://169.254.169.254/latest/meta-data/"

Bypass Techniques to Validate When basic blocklists filter `127.0.0.1` or `localhost`, test whether the parser properly resolves: - Alternative IP representations (`http://2130706433/` or `http://0x7f000001/`) - IPv6 loopback (`http://[::1]/`) - DNS rebinding or `302 Found` HTTP redirects pointing to internal addresses

Defensive Remediation - **Strict Allowlisting**: Validate both the scheme (`https://` only) and the resolved destination IP before dispatching the request. - **Disable automatic redirects**: Prevent the HTTP client from following `301/302` redirects to private RFC1918 or link-local (`169.254.0.0/16`) space. - **IMDSv2 Enforcement**: Require session-oriented tokens (`X-aws-ec2-metadata-token`) on cloud instances so simple `GET` SSRF requests cannot read credentials.