Attack scenario
SSRF – Server-Side Request Forgery
An adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
Why this scenario matters
A vulnerable webhook, import, preview, image, or callback function accepts a URL without proper destination validation. The server makes the request from its trusted position and may expose cloud credentials, internal APIs, or administrative interfaces.
Mitigation requires destination allowlists, safe DNS and redirect handling, blocking of internal and metadata ranges, segmentation, egress control, service isolation, and validation-bypass testing.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Credential Access
- Discovery
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.