Beginner LevelWeb Security & Cyber Defense
What is Server-Side Request Forgery (SSRF) and how do attackers target internal cloud metadata?
❓ Interview Prompt: Explain SSRF, forcing server outbound requests, targeting cloud IMDS endpoints (`169.254.169.254`), and URL validation blacklists.
Server-Side Request Forgery (SSRF) occurs when an attacker forces a vulnerable web server to issue HTTP requests to arbitrary internal network locations:
Attack Target (Cloud Metadata IMDS):
On AWS, EC2 instances can query an internal metadata service at 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'.
•
Exploit: Attacker submits 'POST /api/fetch-url' with payload '{ "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/role" }'.
•
The vulnerable server fetches the internal URL and returns IAM secret access keys to the attacker!
Code Implementation Example
typescript
import ipaddr from 'ipaddr.js';
import dns from 'dns/promises';
async function isSafeUrl(inputUrl: string): boolean {
const parsed = new URL(inputUrl);
const addresses = await dns.resolve(parsed.hostname);
for (const addr of addresses) {
const ip = ipaddr.parse(addr);
// Block internal loopback, private RFC 1918, and link-local (169.254) IPs!
if (ip.range() !== 'unicast') return false;
}
return true;
}💡Validating DNS resolved IP addresses to block SSRF requests to private network ranges.
🎯 Interview Key Takeaway
Prevent SSRF by resolving DNS hostnames and blocking outbound requests to internal, loopback, and cloud metadata IPs.
#SSRF#Cloud Security#AWS IMDS#Beginner
Back to all Web Security & Cyber Defense Questions→