Bug Class Deep Dives
SSRF past the easy filters: URL-parser confusion and the metadata endpoint
The allowlist and the HTTP client parse your URL differently — that gap is where modern SSRF lives. Here's the exact parser-confusion payloads, the IMDSv2 token dance from inside a container, the gopher-to-Redis RCE chain, and why you confirm it out-of-band, not in the response body.
Jul 5, 2026 · 8 min read