Skip to content © 2026 Jer Catallo. Reference material only, always confirm against the official source.
Server-Side Request Forgery (SSRF) incident response playbook · Cybersecurity Atlas
Home Playbook Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) Network & Infrastructure A10:2021 – Server-Side Request Forgery
An attacker induces the server to make HTTP requests to an arbitrary domain or internal resource, potentially exposing cloud metadata, internal services, or sensitive data.
1 Block all outbound requests from the affected service at the network firewall. 2 Rotate any cloud credentials or tokens that may have been exposed via metadata endpoints. 3 Review server logs for evidence of internal network enumeration. 1
Validate and whitelist allowed URL schemes and destinations; block private IP ranges.
2 Disable or restrict IMDS (Instance Metadata Service); enforce IMDSv2 on AWS.
3 Use a dedicated proxy service with strict egress controls for all outbound fetch operations.
4 Sanitize and validate all user-supplied URLs before processing. 1 Apply strict egress firewall rules to application servers. 2 Conduct automated SSRF testing against all URL-accepting endpoints in CI/CD. 3 Implement network segmentation so application servers cannot reach internal management planes. 4 Use SAST rules to flag usage of raw HTTP fetch with user-supplied URLs. URL parameters that fetch remote resources (e.g., webhooks, PDF generators, image importers) Bypassing SSRF filters using URL redirects, DNS rebinding, or encoded characters Accessing cloud instance metadata endpoints (e.g., 169.254.169.254) Port scanning internal networks via SSRF Application logs showing outbound requests to internal IP ranges or metadata endpoints Unexpected DNS lookups for internal hostnames Requests to 169.254.169.254 or localhost from the application server SSRFmap Burp Suite Collaborator Nuclei Trickest
