Web security
Server-Side Request Forgery (SSRF) Explained for Beginners
Server-side request forgery (SSRF) tricks a server into making web requests on the attacker's behalf. Because the server sits inside the network, it can often reach things the attacker cannot: internal admin panels, databases and cloud metadata services. It is counted under broken access control in the OWASP Top 10:2025 and has its own entry in the API Top 10.
How It Works
Many features ask the server to fetch a URL: importing a profile picture from a link, generating a link preview, sending a webhook, converting a web page to PDF. If the server fetches whatever URL it is given, an attacker can point it at an internal address instead.
Why the Cloud Makes It Worse
Cloud servers can query a special internal metadata address to learn about themselves, and in some configurations to obtain temporary credentials. An SSRF that reaches that address can leak keys that unlock the wider cloud account. Cloud providers have added protections, such as requiring a token for metadata requests, but they only help when they are turned on.
Where It Hides
- Fields that accept a URL or a host name
- File imports by link, and document or image converters
- Webhooks and integrations
- XML parsers that resolve external entities
- Headers some servers use to build requests
Blind SSRF
Often the server makes the request but does not show the response. Testers then confirm the flaw by pointing it at a server they control and watching for the incoming request, in authorized tests only.
How Developers Prevent It
- Allow only the specific destinations a feature needs, rather than trying to block bad ones
- Resolve the host name and reject internal, loopback and link-local addresses, then connect to the checked address
- Do not follow redirects blindly
- Turn on the cloud provider's metadata protections
- Segment the network so the application server cannot reach what it does not need
- Do not return raw fetched responses to users
Related Reading
SSRF often appears alongside other API flaws; see the OWASP API Security Top 10. The OWASP Top 10 explained covers where it sits in the 2025 web list.
Learning Web and API Testing
SSRF is part of the web-to-API attack chains in our Application Security course, tested in authorized labs with Burp Suite.
Want to learn web testing step by step? Book free trial classes. Contact us or call +91 86868 92922.
Courses Mentioned in This Guide
More Guides
OWASP API Security Top 10 Explained for Beginners
The OWASP API Security Top 10 (2023) in plain language: BOLA, broken authentication, property and function-level authorization, SSRF and more.
Read the guide →Bug Bounty for Beginners in India: How to Start Safely
How bug bounty programs work, the skills you need first, how to read scope and rules, write a good report, and avoid legal trouble as a beginner in India.
Read the guide →Burp Suite for Beginners: Proxy, Repeater and Intruder Explained
Get started with Burp Suite: Community vs Professional, setting up the proxy, and using Proxy, Repeater, Intruder and Decoder to test web applications legally.
Read the guide →JWT Security Explained: Common JSON Web Token Flaws
How JSON Web Tokens work and the flaws testers look for: unverified signatures, the none algorithm, weak secrets, key confusion, long expiry and data leaks.
Read the guide →Start Your Cyber Security Career
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps