# Server-side Request Forgery

> Discover and exploit SSRF to reach internal services, steal cloud metadata credentials, read local files, and bypass destination filters.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-26
- **Updated:** 2026-09-26

Server-side request forgery (SSRF) tricks the server into making HTTP or other requests on the attacker's behalf. Because the request originates from the server, it can reach internal services, cloud metadata endpoints, and resources that are firewalled off from the internet. SSRF is a high-impact bug: it turns a web application into a proxy into the internal network and, in cloud environments, into a path to credential theft and full account compromise.

## SSRF Discovery

Detection looks for any feature where the server fetches a URL: webhooks, URL previews, PDF generators, image loaders, and XML input. Out-of-band callbacks confirm the server makes the request, cloud metadata probes test for high-value internal endpoints, and redirect chains and XML-based vectors expose less obvious SSRF. Cataloging every server-initiated request is the core of discovery.

## SSRF Exploitation

Exploitation targets cloud metadata services (AWS IMDS, GCP, Azure) for credential theft, reaches internal-only services, reads local files via file://, and uses the gopher protocol for raw TCP to interact with non-HTTP services. Blind SSRF requires inference techniques, and filter bypasses (alternate encodings, DNS rebinding, redirect abuse) defeat allowlists and blocklists that try to constrain the destination.

## Study material

- [SSRF Detection](https://hackindex.io/services/web/vulnerability-discovery/ssrf-detection.md) (read, core)
- [SSRF Exploitation](https://hackindex.io/services/web/exploitation/ssrf-exploitation.md) (read, core)