How To: Server-Side Request Forgery (SSRF)

This blog post explains Server-Side Request Forgery (SSRF): how it arises, how to test for it, practical exploitation techniques (including redirects, protocol pivots, and using internal services), and the typical impact such as internal service exposure, port scanning, and retrieval of EC2 instance metadata. It includes runnable examples, testing tips (netcat listener, timing-based discovery), common vulnerable features (webhooks, PDF generators, link expansion, file uploads), mitigation pitfalls (host blacklists, redirect handling), and suggested offensive pivots to increase impact.