SSRF: turning the server into a proxy

February 2, 2026 · 1 min read · #web #ssrf #cloud

Server-side request forgery: the app makes an HTTP request to a URL you control. The server can reach internal networks you cannot.

The classic target: cloud metadata

On AWS/GCP/Azure a local endpoint exposes the instance's credentials:

http://169.254.169.254/latest/meta-data/iam/security-credentials/

An SSRF reaching that IP returns valid temporary keys. From there the attacker enters the cloud account.

Defence

Whitelist allowed domains/IPs, never blacklist. Block private and link-local IPs (169.254.0.0/16, 10/8, 127/8) after DNS resolution, not before (mind DNS rebinding). On AWS enforce IMDSv2, which requires a token and blocks trivial SSRF access.

« back to home