You finished API7 — Server Side Request Forgery. Here’s what you now understand:
✓What SSRF is — an API that fetches user-supplied URLs server-side, letting the attacker make the server reach internal targets it can’t access directly
✓Why APIs are specifically exposed — webhooks, file import, link preview, and integration features are all legitimate URL-fetching patterns that become SSRF vectors
✓The cloud metadata jackpot — 169.254.169.254 returns IAM credentials; SSRF that reaches it yields cloud account access
✓Two attack patterns: cloud credential theft (SSRF → metadata → IAM keys → cloud data) and internal network pivot (SSRF → internal services that trust internal callers)
✓Real incidents — Capital One 2019 ($270M total cost, 100M records) and GitLab CVE-2021-22214 (unauthenticated SSRF via CI lint API)
✓Three bypass techniques — DNS rebinding, redirect chains, and alternative IP notations — and why allowlists + IP validation + redirect disabling are required together
✓Seven mitigations: URL allowlist, post-DNS IP validation, disable redirects, no raw response return, internal service auth, network isolation, and metadata endpoint monitoring