NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
SSRF (Server-Side Request Forgery)
Master Server-Side Request Forgery (SSRF). Learn to exploit URL parameters, access internal services, dump cloud metadata, and bypass WAF filters.
Room tasks
1What is SSRF & Why It's Dangerous
2Finding SSRF in URL Parameters & Webhooks
3Exploiting SSRF to Access Internal Services
4Cloud Metadata Exploitation via SSRF
5Bypassing SSRF Filters & Blocklists
6Guided Lab: Pivoting to Internal Network via SSRF
Frequently Asked Questions
What is SSRF?
Server-Side Request Forgery tricks a server into sending requests to a destination the attacker chooses. It can reach internal services, admin panels, or cloud metadata endpoints that are not exposed to the internet.
Why is SSRF dangerous in the cloud?
Cloud instances expose a metadata service at a link-local address that can return temporary credentials. If an SSRF flaw can reach it, attackers may steal those credentials and access cloud resources.
How can SSRF be prevented?
Use allowlists for destinations, block internal and link-local ranges, disable unused URL schemes, and enforce network egress controls. This beginner-friendly SSRF room on Codelivly is free and hands-on.