server-side request forgery

SSRF turns the server into a confused deputy: anywhere it makes outbound HTTP requests on user-controlled input, an attacker can pivot to internal services, cloud metadata endpoints, or non-HTTP protocols via URL parsing differences.

The labs cover blind and non-blind SSRF, IMDS exploitation (AWS, GCP, Azure), URL parser confusion, DNS rebinding, gopher protocol smuggling, and the chain to RCE through internal admin panels.