Server-Side Request Forgery

Normally can be seen when an application seems to take internal URLs or network resources that may be able to be modified.

We can find a typical example of this vulnerability as follows:

• A web application allows users to retrieve images by specifying a URL

https://$url/fetch?url=http://$url/image.jpg

---

• If vulnerable we could replace the reference to the image location with an internal URL

https://$url/fetch?url=http://localhost/admin