---
note type:
  - security
  - theory
date: 2026-06-03
done: true
---
This is a critical web security vulnerability where an attacker manipulates a server into making unauthorised HTTP requests to internal or external resources on the attacker's behalf.

## How SSRF Attacks Work

In a typical SSRF attack, the attacker manipulates input fields (such as URL parameters, form fields, or HTTP headers) that the server uses to initiate a request. Because the request originates from the trusted server itself, it often bypasses firewalls, VPNs, and network segmentation that would block direct external access. 

### Common Attack Vectors

- **Cloud Metadata Services:** Attackers often target cloud provider metadata endpoints (e.g., `http://169.254.169.254/` in AWS) to steal temporary credentials and configuration data. 
    
- **Internal Services:** Requests can be directed to internal administrative dashboards, databases with HTTP interfaces (like MongoDB or Redis), or other backend services lacking authentication. 
    
- **Local File System:** By using the `file://` protocol, attackers may attempt to read sensitive files on the server (e.g., `/etc/passwd`). 
    
- **Port Scanning:** SSRF can be used to scan internal networks for open ports and running services by observing response times or error messages.

![[Pasted image 20260602161410.png]]