thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Server-Side Request Forgery (SSRF)

An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.

Definition

SSRF abuses features that fetch URLs, letting attackers reach internal services, cloud metadata endpoints such as 169.254.169.254, or bypass firewalls. The 2019 Capital One breach used SSRF to obtain AWS credentials. Allowlisting destinations, blocking metadata access and IMDSv2 mitigate it.

Example

Submitting http://169.254.169.254/latest/meta-data/iam/security-credentials/ to an image URL fetcher.

Exam tip

In cloud scenarios, SSRF to the metadata service is the classic exam case; IMDSv2 mitigates it.

Don't confuse it with

Related terms