🌐 Server-Side Request Forgery (SSRF) Attack Flow
Abusing Server-Side HTTP Requests to Access Internal Resources
flowchart TD
A[👤 Attacker] -->|1. Craft malicious URL| B[🌐 Vulnerable Web App]
B -->|2. Server makes request| C[🔥 Firewall Bypass]
C -->|3. Access internal network| D[🏢 Internal Services]
D -->|4. AWS Metadata endpoint| E[☁️ Cloud Metadata]
D -->|5. Internal APIs/DBs| F[(💾 Internal Resources)]
D -->|6. Admin panels| G[⚙️ Management Interfaces]
E -->|7. Return credentials| B
F -->|8. Return sensitive data| B
G -->|9. Return admin info| B
B -->|10. Leak to attacker| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
H[🔒 Defense:
URL Whitelist] -.->|Allow only trusted hosts| B
I[🛡️ Defense:
Network Segmentation] -.->|Isolate internal| D
J[⚙️ Defense:
Disable URL Schemas] -.->|Block file:// gopher://| B
style H fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style I fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Identify SSRF Vector: Find endpoints that fetch external resources.
POST /api/fetch-image?url=https://example.com/logo.png
2
Target Internal Services: Point to internal IP addresses.
url=http://192.168.1.1/admin
url=http://localhost:6379/ (Redis)
3
Cloud Metadata Exploitation: Access cloud provider metadata APIs.
url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS)
url=http://metadata.google.internal/computeMetadata/v1/ (GCP)
4
Protocol Smuggling: Use different URL schemes to interact with internal services.
url=file:///etc/passwd
url=gopher://localhost:25/ (SMTP)
5
Port Scanning: Enumerate open ports on internal network.
url=http://internal-host:8080/
6
Bypass Filters: Use DNS rebinding, URL encoding, or IP obfuscation.
url=http://127.0.0.1 → http://2130706433/ (decimal IP)
7
Data Exfiltration: Retrieve credentials, API keys, or sensitive configuration.
🛡️ Defense Mechanisms
✅ Input Validation with Whitelist:
Only allow requests to a predefined list of trusted domains.
allowed_hosts = ['api.trusted.com', 'cdn.safe.net']
✅ Block Private IP Ranges:
Prevent requests to internal networks and localhost.
Block: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
✅ Disable Unnecessary Protocols:
Only allow HTTP/HTTPS, block file://, gopher://, ftp://, etc.
if (!url.startsWith('https://')) reject();
✅ Network Segmentation:
Isolate web servers from internal infrastructure.
Use firewalls to restrict outbound connections.
✅ Disable Cloud Metadata Access:
Use IMDSv2 (AWS) which requires session tokens.
aws ec2 modify-instance-metadata-options --http-tokens required
✅ Use Safe HTTP Libraries:
Configure libraries to prevent redirects to private IPs.
requests.get(url, allow_redirects=False, timeout=5)