TechKnowSurge
TechKnowSurge Catalog Videos Server-Side Request Forgery (SSRF)
VideoSecurityFree

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) is a vulnerability in which an attacker manipulates a web server into making requests to internal resources that the attacker cannot reach directly. It is classified under the Confused Deputy category in the Common Weakness Enumeration (CWE-918).

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Server-Side Request Forgery (SSRF), identified as CWE-918 in the Common Weakness Enumeration, is a web application vulnerability that allows an attacker to use a publicly accessible web server as a proxy to reach internal resources that are not directly exposed to the internet. The web server receives a crafted URL or request from the attacker, fetches the requested content using its own internal access privileges, and returns the result — delivering sensitive information to a party who should never have had access to it. This misuse of the server's trusted position is precisely why SSRF is classified as a subtype of the Confused Deputy vulnerability pattern. In a typical SSRF scenario, the attacker lacks direct network access to back-end systems, databases, or internal services, but the web server does not share that restriction. By supplying a malicious URL or request parameter, the attacker instructs the server to act on its behalf, effectively circumventing perimeter controls and firewall rules. Understanding SSRF is essential for security professionals involved in web application security, penetration testing, or secure development, as it represents a class of attack that exploits trust relationships rather than simple authentication failures.

What you'll learn

What's covered

Server-Side Request Forgery (SSRF)

Key terms

Server-side Request Forgery
SSRF
Server-side Request Forgery is a web vulnerability allowing attackers to induce the server to make HTTP requests to internal or external resources, bypassing network controls and accessing internal services.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Server
A computer or program that provides services or resources to other devices, known as clients, over a network.
Threat Actor
An individual or group responsible for a security incident or attack.
Confused Deputy
An attack pattern where a lower-privileged process tricks a higher-privileged process into performing unauthorized actions on its behalf by exploiting the trusted process's authority.

Topics

Ssrf Web Security Confused Deputy Cwe 918 Application Security

Transcript

Server-Side Request Forgery

One example of the confused deputy is the SSRF, or server-side request forgery.

We're back on the Common Weakness Enumeration site. I'm going to expand all down here, and this time we're going to do a search for SSRF. We can see there's just one here, and it's a subcategory of confused deputy. So let's take a look at the server-side request forgery, or CWE-918.

If we take a look at it, there is a diagram on this one, and it says the web server — so we're dealing with a web server here — receives a URL or similar request from the upstream component and retrieves the content of the URL. So it's essentially delivering unexpected information to the adversary.

Here we have a set of web servers right here, and an adversary. The adversary makes a call to these web servers, and the adversary doesn't have direct access to these resources right here, but the web server does. So the web server then returns that information to the adversary, and the adversary gains access then to these resources that they shouldn't have access to.

So an SSRF is when an adversary uses a web server to gain access to internal resources.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →