SSRF: When Your Server Becomes the Attacker's Proxy

One innocent feature

Somewhere in your app there is a line that fetches a URL a user gave you.
"Import your profile picture from a link." "We'll POST to your webhook when
the job finishes." "Paste the URL of the CSV and we'll import it." Each is a
normal, useful feature. Each is also a loaded gun pointed at your own
infrastructure.

The pattern is always the same: the user controls a URL, and your server
— not the user's browser — makes the request. That distinction is
everything. Your server sits inside the trust boundary. It can reach the
database, the cache, the internal admin panel, and, in the cloud, a magic
address that will happily print out your credentials. This is Server-Side
Request Forgery (SSRF): you build an HTTP client, and an attacker borrows it.

The attack

Give a naive fetcher an attacker-chosen URL and watch what it can reach: