Testing for SSRF with Burp Suite - Port Swigger
Summary: PortSwigger's guide describes server-side request forgery (SSRF) as a vulnerability that lets an attacker induce a server-side application to make requests to an unintended location, potentially reaching back-end systems not normally publicly available, often via non-routable private IP addresses. It walks through testing with Burp Intruder to enumerate internal IP addresses and private host names for differing responses, using the stock check feature and its stockApi parameter in the Basic SSRF against a backend system lab.
What you should know: A single request parameter that accepts a full or partial URL can be enough to turn your own server into a proxy into private back-end systems, and Intruder makes enumerating those internal addresses a matter of minutes.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026