SSRF Shapes
Server fetches a URL from input — allowlist destinations. No metadata probes.
Visual · api_ssrf_shapes
SSRF is server-side fetch abuse. Original Cyberlium.
If your server retrieves URLs for users, you own a fetch policy.
SSRF tricks the server into calling internal hosts. Teach the shape and allowlist defenses. Do not probe cloud metadata endpoints as homework.
1. Shape
Client supplies URL. Server fetches it. Attacker aims at internal IPs/services.
PDF renderers, webhooks, importers are classic sinks.
Command guide
Try these commands — Shape
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SSRF prevention — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html OWASP API7 — https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X POST http://127.0.0.1:8818/fetch-url -H "Content-Type: application/json" -d '{"url":"http://127.0.0.1:8818/health"}' | head -c 300
curl -sS -o /dev/null -w "blocked metadata URL %{http_code}
" -X POST http://127.0.0.1:8818/fetch-url -H "Content-Type: application/json" -d '{"url":"http://169.254.169.254/"}'Primary tools to practice this lesson: curl. Reference sites: SSRF prevention (https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html); OWASP API7 (https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defenses
Allowlist schemes/hosts. Block link-local and metadata ranges. Auth on webhooks.
Network egress controls help.
3. Course refusal
No homework probing 169.254.169.254 or internal corp ranges.
Write the policy; use diagrams, not live cloud abuse.
4. What you ship: SSRF policy
Shape named. Allowlist defense. Metadata probes refused.
5. What you record before the next lesson
Policy sentences.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Probe cloud metadata from a stolen key for class.
- Right: Write policy. Next: defense lab.
Mission: SSRF policy sheet
1) Define SSRF shape. 2) Write allowlist defense. 3) Write NEVER metadata probes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Example allowlist for webhooks?”
APPLY: SSRF involves:
APPLY: True or False: Metadata probing is required homework.
APPLY: Defense: