SSRF: when the server makes the request
URL imports, webhooks and link previews as trust boundaries.
Find the server-side request
An image-import or webhook-verification feature may contact a supplied address from the server. This differs from a user navigating in a browser: the server has a different network environment and access to different resources.
Start with an address you control
In an agreed lab environment, use an observation endpoint you control. A unique request marker helps connect a callback to a particular test. Remember that a separate scanner may also visit the link, so one log event is not enough for a final conclusion.
Separate the fact from the impact
Confirming an outbound request does not automatically demonstrate access to an internal network. Distinguish proven behavior from possible risk in the report. Access to internal resources requires a separately authorized scenario, not random probing of addresses.
Restrict destinations
Where possible, allow only required destinations and protocols. Validation needs to account for name resolution and redirects. Network-level restrictions on outbound traffic complement application checks and reduce the consequences of a mistake.