Server-side request forgery and URL resolution

Mechanism

SSRF turns a server-side fetch capability into a request to an unintended destination. It may expose responses directly, offer a status or timing oracle, or merely trigger an outbound connection. The decisive trust boundary is between user-supplied URL information and the destination actually contacted after parsing, DNS resolution, redirects, and proxy routing.

Practical method

Begin with a callback endpoint you control inside the lab and record DNS and HTTP events separately. Enumerate accepted schemes, methods, ports, and redirect behavior. Compare the validated hostname with the resolved address and repeat after redirects. In cloud challenges, identify the metadata protocol and token requirements instead of assuming all providers accept an identical request.

input URL -> parser -> allowlist -> DNS -> connect -> redirect
                              ^ destination must remain allowed

Interpreting evidence

A callback confirms an outbound request, but not access to internal responses. Distinguish DNS-only resolution, connection attempts, successful HTTP requests, and bytes reflected to the client. Document which request headers and body fields are under your control.

Pitfalls and limits

Blocklisting one spelling of localhost leaves alternate IP representations and DNS changes unresolved. A redirect can change both host and scheme. Cloud metadata protection can block a simple GET without eliminating the general fetch primitive.

Selected licensed upstream examples

These loopback representations probe hostname handling, IPv6 parsing, and IPv4 loopback-range checks separately. Test only against the isolated challenge destination. Acceptance as a URL does not ensure that the backend resolver or connection API interprets it identically. External public redirect domains and copied research examples are excluded from this selection.

http://localhost:80
http://[0000::1]:80/
http://127.0.1.3

Attribution: PayloadsAllTheThings; MIT. Selected lines, explanatory notes added. Pinned upstream file.