Understanding SSRF: Concepts, Patterns and Practical Exploitation Server-Side Request Forgery (SSRF) is one of the most dangerous web application vulnerabilities because it allows attackers to make a …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A practical walkthrough of Server-Side Request Forgery (SSRF) covering core concepts, recognition patterns, and hands-on exploitation. Explains both regular and blind SSRF, common vulnerable input types (URL parameters, hidden fields, hostnames, paths), and real-world features prone to SSRF like webhooks and PDF generators. Demonstrates a TryHackMe lab scenario where a deny list is bypassed using path normalization (x/../private) to access a restricted /private endpoint, with the server returning base64-encoded content that reveals the protected resource.