What is SSRF? Server-Side Request Forgery and the Attack That Breached Capital One
- Created
- 15 Oct 2025
- Last reply
- about 1 year ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article What is SSRF? Server-Side Request Forgery and the Attack That Breached Capital One.
SSRF tricks your server into making requests to internal systems — cloud metadata services, internal APIs, AWS credentials endpoints. It turned a WAF misconfiguration into 100 million stolen Capital One records
Discussion thread — share findings, corrections and follow-ups below.