To test for server side request forgery, find every parameter that makes the server fetch a URL, point it at a host you control to confirm a callback, then at internal addresses to see whether the server will reach them. Fixes that hold are allowlists, disabled redirects and checks at connection time.
Where SSRF hides
Look for webhooks, link previews, image or file import by URL, PDF generators, and any field named url, callback, feed or avatar. OWASP lists SSRF as API7 in the 2023 API Security Top 10.
Test cases
| Input | Purpose | Safe result |
|---|---|---|
| Your own callback host | Prove the server fetches | Blocked unless allowlisted |
| Loopback address | Reach local services | Blocked |
| Private network range | Reach internal systems | Blocked |
| Cloud metadata address | Reach instance credentials | Blocked |
| URL that redirects inward | Bypass the first check | Redirect not followed |
| Hostname resolving to internal IP | Bypass name checks | Blocked after resolution |
Steps
- Inventory every feature where the server requests a user-supplied location.
- Use a callback service you control and watch for the request.
- Try internal and metadata addresses in a non-production environment only.
- Try a redirect from an allowed host to an internal one.
- Try a hostname you control that resolves to an internal address.
- Compare the response for blocked and open ports, since timing and error differences leak information.
Which fixes hold
OWASP's prevention guidance separates two cases. If the app talks to a known set of services, use an allowlist and network controls. If it must reach arbitrary external hosts, a deny list is the fallback, and it is prone to bypass. It says to disable redirect following, and that domain allowlisting alone does not stop DNS rebinding, so resolve the name, check every returned IP and connect to the validated address. On AWS, it advises moving to the newer metadata service version and disabling the old one.
Network layer
Firewall rules that block internal ranges from the fetching service remain valuable, because application checks can have gaps.
Try it yourself
Check how the demo reports parameters that accept URLs.
Click through it at your own pace, or open it full screen.
Quick check
Is SSRF only a cloud problem?
No. Cloud metadata makes it severe, but internal admin tools and databases are reachable from any network the server can see.
Is a deny list enough?
It is a last resort. Prefer an allowlist, plus redirect and DNS controls.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
