Episode 89: Server-Side Request Forgery (SSRF)

Some of the most dangerous requests come from inside the house. In this episode, we unpack Server-Side Request Forgery (SSRF), a vulnerability that allows attackers to trick a server into sending requests to internal services, external endpoints, or cloud metadata APIs. You’ll learn how attackers abuse server-side functionality to pivot into otherwise inaccessible environments, bypass firewalls, or extract sensitive data.

We cover how SSRF shows up in APIs, file-fetching features, and redirect mechanisms—and how input filtering alone often isn’t enough to stop it. This episode helps you recognize SSRF patterns during assessments, understand the risks in cloud-native environments, and apply mitigations like allowlists, firewall rules, and metadata protection. SSRF is increasingly emphasized in exams and real-world attacks, making this a must-know for every analyst. Brought to you by BareMetalCyber.com