# SSRF (Server-Side Request Forgery)

> Master Server-Side Request Forgery (SSRF). Learn to exploit URL parameters, access internal services, dump cloud metadata, and bypass WAF filters.

Canonical: https://codelivly.com/rooms/ssrf
Last updated: 2026-07-29

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 6 |
| Estimated time | 30 min |
| XP | 200 |

A comprehensive module covering the mechanics and exploitation of Server-Side Request Forgery (SSRF). Discover how to identify SSRF in URL parameters and webhooks, pivot to internal network services, extract critical cloud metadata (AWS/Azure/GCP), and bypass modern SSRF filters. Includes a guided lab to solidify your internal network pivoting and cloud exploitation skills.

## Lessons

1. What is SSRF & Why It's Dangerous (30 min)
2. Finding SSRF in URL Parameters & Webhooks (30 min)
3. Exploiting SSRF to Access Internal Services (30 min)
4. Cloud Metadata Exploitation via SSRF (30 min)
5. Bypassing SSRF Filters & Blocklists (30 min)
6. Guided Lab: Pivoting to Internal Network via SSRF (30 min)

## Related

- [Learning path: Web Application Security](https://codelivly.com/learning-paths/web-application-security)
- [All rooms](https://codelivly.com/rooms)