What it is
SSRF arises when an application fetches a user-supplied URL without restriction. The attacker points it at internal hosts, link-local cloud metadata (169.254.169.254), or alternate schemes — turning the trusted server into a proxy into the internal network.
How to test for it
Supply URLs you control and watch for inbound callbacks, then pivot to internal targets and the cloud metadata service. Defeat naive allow-lists with redirects, DNS rebinding, alternate IP encodings, and non-HTTP schemes.
How to prevent it
Validate and canonicalise URLs against a strict allow-list of hosts and schemes, resolve and re-check the destination IP to block internal ranges, disable unused URL schemes, and require IMDSv2 / drop metadata access where possible.