Introduction to SSRF

About This Course

This course teaches SSRF prevention techniques for Java web applications, progressing from core concepts to Spring Boot implementation: Unit 1 : Core SSRF concepts using plain Java - you'll learn to detect and understand SSRF vulnerabilities using fundamental Java APIs Units 2-4 : Spring Boot implementation - you'll apply these concepts in modern Spring Boot applications with framework-specific features We start with plain Java to ensure you understand the underlying security principles before leveraging Spring Boot's conveniences. This foundation will help you secure any Java web application, regardless of the framework.

Introduction to SSRF

Welcome to the very first lesson of the Server-Side Request Forgery (SSRF) Prevention in Java course! In this lesson, we will explore Server-Side Request Forgery (SSRF), a critical security vulnerability that can affect web applications. SSRF occurs when an attacker tricks a server into making unauthorized requests on their behalf. This can lead to the exposure of sensitive information or unauthorized actions within a network. Understanding SSRF is crucial for building secure applications and protecting against potential threats. Let's dive into the mechanics of SSRF to see how these vulnerabilities occur. 🚀

Understanding SSRF

To understand SSRF, it's important to differentiate between client-side and server-side requests. In a typical web application, client-side requests are made by the user's browser, while server-side requests are made by the server itself. SSRF vulnerabilities occur when an attacker manipulates server-side requests to access unauthorized resources. Imagine a scenario in which a web application allows users to input a URL to fetch data. If the application doesn't properly validate the input, an attacker could input a URL pointing to an internal resource, such as a private server. Internal resources typically include services like internal dashboards, internal APIs, or even databases that are not exposed to the public internet. These systems are usually protected by network-level restrictions like firewalls or NAT, meaning users on the internet shouldn't be able to access them directly. However, because the server itself is inside the protected network, it can access these systems. By leveraging SSRF, attackers exploit this trust boundary and trick the server into making requests to sensitive endpoints on their behalf — essentially bypassing external access restrictions.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

┌──────────────┐
│   Attacker   │
└──────┬───────┘
       │ 1. Malicious URL
       │    (e.g., http://internal-server/admin)
       ▼
┌──────────────────────┐
│   Web Application    │
│   (Public Server)    │
└──────┬───────────────┘
       │ 2. Server makes request
       │    on behalf of attacker
       ▼
┌─────────────────────────────────┐
│   Firewall/Network Boundary     │
└─────────────────────────────────┘
       │ 3. Request passes through
       │    (server is trusted)
       ▼
┌──────────────────────┐
│  Internal Resource   │
│  (Database, Admin,   │
│   Metadata Service)  │
└──────────────────────┘

┌──────────────┐
│   Attacker   │
└──────┬───────┘
       │ 1. Malicious URL
       │    (e.g., http://internal-server/admin)
       ▼
┌──────────────────────┐
│   Web Application    │
│   (Public Server)    │
└──────┬───────────────┘
       │ 2. Server makes request
       │    on behalf of attacker
       ▼
┌─────────────────────────────────┐
│   Firewall/Network Boundary     │
└─────────────────────────────────┘
       │ 3. Request passes through
       │    (server is trusted)
       ▼
┌──────────────────────┐
│  Internal Resource   │
│  (Database, Admin,   │
│   Metadata Service)  │
└──────────────────────┘

Java

// Example of a vulnerable server-side request
public class SSRFExample {
    public static void fetchData(String url) {
        // Server makes a request to the provided URL without validation
        System.out.println("Fetching data from: " + url);
    }

    public static void main(String[] args) {
        String userInput = "http://internal-server.local/data";
        fetchData(userInput);
    }
}

// Example of a vulnerable server-side request
public class SSRFExample {
    public static void fetchData(String url) {
        // Server makes a request to the provided URL without validation
        System.out.println("Fetching data from: " + url);
    }

    public static void main(String[] args) {
        String userInput = "http://internal-server.local/data";
        fetchData(userInput);
    }
}

Shell

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Java

import java.net.URL;
import java.net.MalformedURLException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Arrays;
import java.util.List;

public class SSRFDetection {

    private static final List<String> LOCALHOST_HOSTNAMES = Arrays.asList(
        "127.0.0.1", "localhost", "0.0.0.0", "::1"
    );

    private static final Pattern[] PRIVATE_IP_PATTERNS = new Pattern[] {
        Pattern.compile("^10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^192\\.168\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3}$")
    };

    public static boolean isDangerousHost(String host) {
        if (LOCALHOST_HOSTNAMES.contains(host)) {
            return true;
        }
        for (Pattern pattern : PRIVATE_IP_PATTERNS) {
            Matcher matcher = pattern.matcher(host);
            if (matcher.matches()) {
                return true;
            }
        }
        return false;
    }

    public static boolean isSSRFVulnerable(String urlString) {
        try {
            URL url = new URL(urlString);
            String hostname = url.getHost();

            // Check for localhost variants and private IPs in the main hostname
            if (isDangerousHost(hostname)) {
                return true;
            }

            // Check for dangerous patterns in query parameter values
            String query = url.getQuery();
            if (query != null) {
                String[] params = query.split("&");
                for (String param : params) {
                    String[] keyValue = param.split("=", 2);
                    if (keyValue.length == 2) {
                        String value = keyValue[1];
                        // If value looks like a host or IP, check it
                        if (isDangerousHost(value)) {
                            return true;
                        }
                        // If value is a URL, check its hostname
                        try {
                            URL paramUrl = new URL(value);
                            if (isDangerousHost(paramUrl.getHost())) {
                                return true;
                            }
                        } catch (MalformedURLException e) {
                            // Not a URL, skip
                        }
                    }
                }
            }
            return false;
        } catch (MalformedURLException e) {
            return false;
        }
    }

    public static void main(String[] args) {
        String url = "http://127.0.0.1/admin";
        System.out.println("Is SSRF Vulnerable: " + isSSRFVulnerable(url));
    }
}

import java.net.URL;
import java.net.MalformedURLException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Arrays;
import java.util.List;

public class SSRFDetection {

    private static final List<String> LOCALHOST_HOSTNAMES = Arrays.asList(
        "127.0.0.1", "localhost", "0.0.0.0", "::1"
    );

    private static final Pattern[] PRIVATE_IP_PATTERNS = new Pattern[] {
        Pattern.compile("^10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^192\\.168\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3}$")
    };

    public static boolean isDangerousHost(String host) {
        if (LOCALHOST_HOSTNAMES.contains(host)) {
            return true;
        }
        for (Pattern pattern : PRIVATE_IP_PATTERNS) {
            Matcher matcher = pattern.matcher(host);
            if (matcher.matches()) {
                return true;
            }
        }
        return false;
    }

    public static boolean isSSRFVulnerable(String urlString) {
        try {
            URL url = new URL(urlString);
            String hostname = url.getHost();

            // Check for localhost variants and private IPs in the main hostname
            if (isDangerousHost(hostname)) {
                return true;
            }

            // Check for dangerous patterns in query parameter values
            String query = url.getQuery();
            if (query != null) {
                String[] params = query.split("&");
                for (String param : params) {
                    String[] keyValue = param.split("=", 2);
                    if (keyValue.length == 2) {
                        String value = keyValue[1];
                        // If value looks like a host or IP, check it
                        if (isDangerousHost(value)) {
                            return true;
                        }
                        // If value is a URL, check its hostname
                        try {
                            URL paramUrl = new URL(value);
                            if (isDangerousHost(paramUrl.getHost())) {
                                return true;
                            }
                        } catch (MalformedURLException e) {
                            // Not a URL, skip
                        }
                    }
                }
            }
            return false;
        } catch (MalformedURLException e) {
            return false;
        }
    }

    public static void main(String[] args) {
        String url = "http://127.0.0.1/admin";
        System.out.println("Is SSRF Vulnerable: " + isSSRFVulnerable(url));
    }
}

Java

public class SchemeDetection {
    private static final String[] UNSAFE_SCHEMES = {
        "file://", "gopher://", "data:", "dict://", "ftp://"
    };

    public static boolean hasUnsafeScheme(String url) {
        String lowerUrl = url.toLowerCase();
        for (String scheme : UNSAFE_SCHEMES) {
            if (lowerUrl.startsWith(scheme)) {
                return true;
            }
        }
        return false;
    }

    public static void main(String[] args) {
        String unsafeUrl = "file:///etc/passwd";
        System.out.println("Has Unsafe Scheme: " + hasUnsafeScheme(unsafeUrl));
    }
}

public class SchemeDetection {
    private static final String[] UNSAFE_SCHEMES = {
        "file://", "gopher://", "data:", "dict://", "ftp://"
    };

    public static boolean hasUnsafeScheme(String url) {
        String lowerUrl = url.toLowerCase();
        for (String scheme : UNSAFE_SCHEMES) {
            if (lowerUrl.startsWith(scheme)) {
                return true;
            }
        }
        return false;
    }

    public static void main(String[] args) {
        String unsafeUrl = "file:///etc/passwd";
        System.out.println("Has Unsafe Scheme: " + hasUnsafeScheme(unsafeUrl));
    }
}

Java

import java.util.regex.Pattern;

public class URLValidation {

    private static final Pattern URL_PATTERN = Pattern.compile(
        "^https?://[^\\s/$.?#].[^\\s]*$", Pattern.CASE_INSENSITIVE
    );

    public static boolean isValidAndSafeURL(String url) {
        // Check basic URL format
        if (!URL_PATTERN.matcher(url).matches()) {
            return false;
        }

        // Check for unsafe targets
        if (SSRFDetection.isSSRFVulnerable(url) || SchemeDetection.hasUnsafeScheme(url)) {
            return false;
        }

        // Additional checks could be added here
        return true;
    }

    public static void main(String[] args) {
        String testUrl = "http://example.com";
        System.out.println("Is Valid and Safe URL: " + isValidAndSafeURL(testUrl));
    }
}

┌──────────────┐
│   Attacker   │
└──────┬───────┘
       │ 1. Malicious URL
       │    (e.g., http://internal-server/admin)
       ▼
┌──────────────────────┐
│   Web Application    │
│   (Public Server)    │
└──────┬───────────────┘
       │ 2. Server makes request
       │    on behalf of attacker
       ▼
┌─────────────────────────────────┐
│   Firewall/Network Boundary     │
└─────────────────────────────────┘
       │ 3. Request passes through
       │    (server is trusted)
       ▼
┌──────────────────────┐
│  Internal Resource   │
│  (Database, Admin,   │
│   Metadata Service)  │
└──────────────────────┘

Java

// Example of a vulnerable server-side request
public class SSRFExample {
    public static void fetchData(String url) {
        // Server makes a request to the provided URL without validation
        System.out.println("Fetching data from: " + url);
    }

    public static void main(String[] args) {
        String userInput = "http://internal-server.local/data";
        fetchData(userInput);
    }
}

Shell

# Example of targeting cloud metadata service
curl http://vulnerable-app.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

Java

import java.net.URL;
import java.net.MalformedURLException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;
import java.util.Arrays;
import java.util.List;

public class SSRFDetection {

    private static final List<String> LOCALHOST_HOSTNAMES = Arrays.asList(
        "127.0.0.1", "localhost", "0.0.0.0", "::1"
    );

    private static final Pattern[] PRIVATE_IP_PATTERNS = new Pattern[] {
        Pattern.compile("^10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^192\\.168\\.\\d{1,3}\\.\\d{1,3}$"),
        Pattern.compile("^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3}$")
    };

    public static boolean isDangerousHost(String host) {
        if (LOCALHOST_HOSTNAMES.contains(host)) {
            return true;
        }
        for (Pattern pattern : PRIVATE_IP_PATTERNS) {
            Matcher matcher = pattern.matcher(host);
            if (matcher.matches()) {
                return true;
            }
        }
        return false;
    }

    public static boolean isSSRFVulnerable(String urlString) {
        try {
            URL url = new URL(urlString);
            String hostname = url.getHost();

            // Check for localhost variants and private IPs in the main hostname
            if (isDangerousHost(hostname)) {
                return true;
            }

            // Check for dangerous patterns in query parameter values
            String query = url.getQuery();
            if (query != null) {
                String[] params = query.split("&");
                for (String param : params) {
                    String[] keyValue = param.split("=", 2);
                    if (keyValue.length == 2) {
                        String value = keyValue[1];
                        // If value looks like a host or IP, check it
                        if (isDangerousHost(value)) {
                            return true;
                        }
                        // If value is a URL, check its hostname
                        try {
                            URL paramUrl = new URL(value);
                            if (isDangerousHost(paramUrl.getHost())) {
                                return true;
                            }
                        } catch (MalformedURLException e) {
                            // Not a URL, skip
                        }
                    }
                }
            }
            return false;
        } catch (MalformedURLException e) {
            return false;
        }
    }

    public static void main(String[] args) {
        String url = "http://127.0.0.1/admin";
        System.out.println("Is SSRF Vulnerable: " + isSSRFVulnerable(url));
    }
}

Java

public class SchemeDetection {
    private static final String[] UNSAFE_SCHEMES = {
        "file://", "gopher://", "data:", "dict://", "ftp://"
    };

    public static boolean hasUnsafeScheme(String url) {
        String lowerUrl = url.toLowerCase();
        for (String scheme : UNSAFE_SCHEMES) {
            if (lowerUrl.startsWith(scheme)) {
                return true;
            }
        }
        return false;
    }

    public static void main(String[] args) {
        String unsafeUrl = "file:///etc/passwd";
        System.out.println("Has Unsafe Scheme: " + hasUnsafeScheme(unsafeUrl));
    }
}

Java

import java.util.regex.Pattern;

public class URLValidation {

    private static final Pattern URL_PATTERN = Pattern.compile(
        "^https?://[^\\s/$.?#].[^\\s]*$", Pattern.CASE_INSENSITIVE
    );

    public static boolean isValidAndSafeURL(String url) {
        // Check basic URL format
        if (!URL_PATTERN.matcher(url).matches()) {
            return false;
        }

        // Check for unsafe targets
        if (SSRFDetection.isSSRFVulnerable(url) || SchemeDetection.hasUnsafeScheme(url)) {
            return false;
        }

        // Additional checks could be added here
        return true;
    }

    public static void main(String[] args) {
        String testUrl = "http://example.com";
        System.out.println("Is Valid and Safe URL: " + isValidAndSafeURL(testUrl));
    }
}

About This Course

Introduction to SSRF

Understanding SSRF

Join the 1M+ learners on CodeSignal

SSRF Attack Flow

SSRF Attack Patterns

Common SSRF Targets

SSRF Detection Techniques

Identifying Internal IPs and Localhost

Detecting Non-HTTP Schemes

Validating URL Format and Domain

Conclusion