Server-Side Request Forgery: Making the Server Fetch What You Want

What it is#

SSRF happens whenever the server fetches a URL on your behalf, and nothing stops that URL from pointing somewhere it shouldn't, like an internal service the outside world can't normally reach.

The labs here#

• SnapProof webhook SSRF: the plain version. A webhook URL field is fetched server-side with no restriction at all, and the response comes back to you, so you can use it to reach internal-only endpoints and read what they say.
• GreenGrid firmware-import redirect SSRF: an allow-list exists this time, and it works, checked once against the URL you submit. The problem is what happens after: the server follows a redirect without re-checking where it lands, so a URL that starts on an allowed host and redirects to an internal one still gets fetched.