SSRF past the easy filters: URL-parser confusion and the metadata endpoint

Sun, 05 Jul 2026 00:00:00 +0000

Server-side request forgery is one of the few bug classes where a single finding hands you cloud credentials. The mechanic is trivial to state — you make a server fetch a URL you control — and every write-up stops there, which is exactly why they’re useless. The tutorial payload, http://169.254.169.254/ pasted into a URL field, has been blocklisted everywhere. The reason SSRF is still one of the most productive bug classes in 2026 isn’t that developers forgot to filter. It’s that their filter and their HTTP client read the URL differently, and you live in the gap.

Oast on Crusader Research

SSRF past the easy filters: URL-parser confusion and the metadata endpoint