Server-Side Request Forgery and File Handling
Server-Side Request Forgery and File Handling covers SSRF, upload flaws, LFI/RFI, path traversal, and deserialization. CWEE tests whether you can turn a server-side primitive into data access, code execution, or cloud credential exposure.
SSRF and file primitives
For SSRF, test URL parameters, webhooks, image fetchers, and PDF generators. Try loopback, private ranges, and cloud metadata endpoints. Bypass naive allowlists with decimal or octal IPs, DNS rebinding, redirects, and URL parser discrepancies. For uploads, check extension and content-type validation, magic bytes, filename traversal, archive extraction, and whether files land in a web-accessible path. For LFI, test traversal depth, null bytes where relevant, wrappers such as php://filter, and log poisoning. Deserialization requires identifying the language and available gadget chains.
Worked example
An avatar fetcher accepts url=http://169.254.169.254/latest/meta-data/iam/security-credentials/. A redirect through an allowed domain reaches the metadata service and returns temporary credentials. That is SSRF with cloud impact. The fix is not a URL blacklist but egress restriction and metadata hardening.
Traps
Blocking 127.0.0.1 alone misses localhost, IPv6, and redirects. Checking only the file extension misses content-type and magic-byte checks. Path traversal may normalize ../; try encoded forms. Deserialization without a gadget is not automatically RCE. Uploaded files need a reachable execution path or parser.