Steal cloud credentials through SSRF and IMDS
A server-side fetch on an EC2 instance reaches the metadata service and its role credentials.
Tag: ssrf
JWT header injection via jku and x5u
If the verifier fetches the key from a URL in the token header, point it at your own JWKS and sign with your matching key.
Find open redirects and unsafe forward targets
Redirects built from request parameters enable phishing and can bootstrap OAuth token theft.
Find SSRF sinks where the URL is user-shaped
Any HTTP client call whose URL derives from input is SSRF unless the host is validated after DNS resolution.
SSRF and internal access through an LLM URL-fetch tool
If the agent can fetch URLs, it is an SSRF primitive with the app's network position; point it at metadata and internal services.
XXE through SVG and Office file uploads
Any feature that parses SVG, DOCX, or XLSX server side is an XML parser you can feed an external entity to.
Defeat SSRF allow-lists with DNS rebinding
When the server validates a hostname then fetches it separately, a TTL-0 record that flips to an internal IP wins the race between the two lookups.
Turn blind SSRF into RCE with a gopher payload to Redis
When a blind SSRF can reach an internal Redis with no auth, gopher lets you write a cron job or webshell and get code execution.