Articles

CRTA - da Aplicação Web ao Domain Admin

Walkthrough de um laboratório de treino da CRTA (Certified Red Team Analyst, CyberWarFare Labs). Cadeia completa, web app, SSRF/LFI…

Security, Guardrails & Sandboxing in AI Agents

Architecting Defense-in-Depth Guardrails, Prompt Injection Sanatization, SSRF Filters, and Isolated Sandbox Execution

Server-Side Request Forgery: Exploiting and Fixing the SSRF Vulnerability

SSRF (Server-Side Request Forgery) makes your own server send requests you never intended, all the way into your internal network. A…

SSRF to Full Cloud Compromise: A Methodology Breakdown

A companion piece to “They Said Our Health Matters. My Privacy Didn’t.” This one is for the security crowd. No target, no identifiers, just…

The Bug I’m Proudest Of Is the One I Deleted

Three real findings on ScribbleMaps, and the SSRF I talked myself out of with a stopwatch. A coordinated-disclosure story about the only…

From URL Preview to Full Cloud Takeover: Deep Dive into Advanced Cloud SSRF

Security vulnerabilities in modern cloud ecosystems often hide behind completely legitimate application functionalities. Among these…

Cisco Unified CM CVE-2026–20230 SSRF Actively Exploited

Cisco has confirmed active exploitation of CVE-2026–20230, a critical Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified…

Spring Boot 4: Secure Your APIs Against SSRF Attacks with Built-in InetAddressFilter

One of the most dangerous and common vulnerabilities in distributed microservice architectures is SSRF (Server-Side Request Forgery).

How I Found CVE-2026–50131: An Incomplete SSRF Fix in Fedify

There is a very specific feeling you get when you are reading security code and something looks almost right.

SSRF Explained Like You Are Five (For Bug Bounty Beginners)

One of the highest paying bugs, finally explained in plain words.

Writeup — Exploiting XXE to Perform SSRF Attacks

This lab shows how an XML External Entity (XXE) vulnerability can be used to perform Server-Side Request Forgery (SSRF). Unlike the…

READING The JavaScript Gave Me a Cross-Tenant Write + SSRF 🔥

Hey Guys and Welcome Back! 👋

SSRF Prevention: How You Actually Close This Off

Three parts covered how bad this gets. This one covers what stops it. Part 4 of the SSRF series.

AWS CloudGoat EC2_SSRF Lab Walkthrough: Step-by-Step Manual Configuration and Exploitation

Overview:

The Laravel Guide to SSRF Defense That Survives Redirects

A hostname allowlist helps at input time. The real attack starts after your server sends the request.

SSRF Explained: Making the Server Your Proxy

When the web application fetches things on your behalf — and you realize you can control what it fetches. Part 1 of the SSRF series.

Threat Intelligence Brief: CVE-2026-40072-SSRF Vulnerability in web3.py

Vulnerability: CVE-2026–40072 Affected Software: web3.py Severity: High (CVSS 3.1: 7.5) / Medium (CVSS 4.0: 6.9) Patched Versions: 7.15.0…

AWS S3 Multi-Bucket Compromise via GraphQL Federation SSRF

Pendahuluan

SSRF with filter bypass via open redirection vulnerability

Lab from Portswigger.

OWASP Top 10 2021 #10 — Server-Side Request Forgery (SSRF) 🌐

The Vulnerability That Turns Your Server Into an Attacker’s Proxy

Lab: SSRF with whitelist-based input filter | SSRF #lab7

Solution:

CVE-2026–44578 Next.js WebSocket SSRF Security Alert Fix

Modern web applications rely heavily on frameworks that simplify development and improve performance for businesses and developers. One of…

SSRF in PDF and HTML Rendering Pipelines: What Puppeteer-Style Services Get Wrong

Originally published at https://koltesecurity.com on May 23, 2026.

Building Another Vulnerable Lab — SSRF.

The previous blog was something that some of you really liked, I did say it was a series so reason enough to do a part two. In this blog…

SSRF in APIs: How a Single URL Parameter Can Expose Internal Systems

A single misconfigured URL parameter can allow an attacker to abuse server-side requests and potentially access internal services, cloud…

Bug Bounty Bootcamp #37: SSRF in PDFs, Screenshots, and Bypassing Localhost Filters

You found a PDF generator that fetches URLs. The developer blocked localhost and 127.0.0.1. Game over? Not even close. Learn the art of…

Building a Web Search MCP Server — DDG, Brave, SQLite, and SSRF Hardening

Part 3 of 6: Giving a local language model access to the live web, safely

SERVER-SIDE REQUEST FORGERY (SSRF) in crAPI

One of the dangerous vulnerabilities in API security is Server-Side Request Forgery (SSRF). It is categorized as API7: Server Side Request…

The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration.

A POST to IMDS may fail — but a redirect can quietly turn it into something else.

Axios Under Siege: SSRF, DoS, and an Active Supply Chain RAT

01 · The axios Threat Landscape in 2026

SSRF Attack — When the Server Becomes the Attacker | CAISD

Normal request

O redirect que você não pediu: SSRF silencioso em clientes HTTP

Seu backend faz uma requisição para uma API externa. Autenticação, dados financeiros, qualquer serviço de terceiro. A resposta chega com…

Plant Photographer TryHackMe Walkthrough (2026) | SSRF to RCE via Werkzeug Console

What looks like a simple file download feature quickly turns into a full server compromise through SSRF, local file read, and a…

CVE-2025–4123 Grafana Open Redirect & SSRF — Full PoC — CVSS 7.6 HIGH

Client-Side Path Traversal in /public/ · No Auth Required · Grafana < 12.0.0

Who Needs VPN?? SSRF Already inside

A bug bounty story about quiet nights, one suspicious parameter, and an unauthenticated path straight into example.com’s internal network.

Exploiting an SSRF Vulnerability to Retrieve the Server Hostname-Hackviser Lab

Server-Side Request Forgery (SSRF) is a common and dangerous web vulnerability that allows an attacker to make the server perform…

Exploiting an SSRF Vulnerability to Access an Internal Service on Port 9090-Hackviser Problem

While solving a challenge on Hackviser, I came across a web application that contained a Server-Side Request Forgery (SSRF) vulnerability…

Exploiting an SSRF Vulnerability to Read /etc/passwd, an Hackervise Challenge Walkthrough

Solving a Bugforge Challenge — Exploiting SSRF in Tanuki

Today, I solved another web challenge on Bugforge, targeting a web application named Tanuki.

☁️ Exploiting AWS CloudGoat (EC2 SSRF Scenario) — Full Vulnerability Assessment Walkthrough

A complete hands-on exploitation of AWS misconfigurations using CloudGoat — covering SSRF, metadata credential theft, S3 exposure, and IAM…

How I Exploited a Secondary Context Bug to Trigger SSRF & Path Traversal in Backend API Calls

Modern Website Architecture

CRITICAL ALERT: Apache Struts2 XXE Exposed (CVE-2025–68493)

ZAST.AI discovered a high severity XXE vulnerability in XWork-Core allows threat actors steal files & trigger SSRF.

The use of an Open Redirect in Server Side Request Forgery (SSRF) — A Portsw

In previous articles, we’ve already covered what Server-Side Request Forgery (SSRF) is. In this post, we’ll look at how open redirects can…

Blind Server Side Request Forgery — A Portswigger

We have already looked at Server-Side Request Forgery (SSRF) and found that exploitation usually relied on one key advantage: visibility…

Smol TryHackMe Walkthrough — From Enumeration to Root 🚀

Target: Smol  Difficulty: Easy → Medium  Skills Demonstrated: Enumeration, WordPress exploitation, SSRF, command execution, reverse shell…

Blind SSRF with Shellshock Exploitation

Exploit Internal Servers via Referer Header Injection.

ZAST.AI identified 6+ vulnerabilities in JeeSite

🔍ZAST.AI identified 6+ vulnerabilities in JeeSite <=5.12.0 b522b3f: • SSRF (CVE-2025–7759) • Multiple Open Redirection flaws…

CyCTF25: Inception — Server-Side Request Forgery (SSRF) via redirect handling

Challenge details:

Dari Teori ke Praktik: SSRF, File Inclusion, dan Command Injection

Artikel ini membahas kerentanan web SSRF, File Inclusion, dan Command Injection lengkap dengan contoh serangan sederhana dan cara memahami…

Uncovering Cloud Security Flaws: How SSRF Exploits IMDSv2 Limitations in AWS

In this blog post, I explore a misconfiguration in AWS’s Instance Metadata Service (IMDSv2) and how a Server-Side Request Forgery (SSRF)…