Score server-side request forgery risk from URL handling, redirect and DNS behaviour, egress controls and cloud metadata reachability.
Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials. SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.
SSRF Risk
Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface).
Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface). Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials.
SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.
This calculator takes 7 inputs: Where the outbound URL comes from, Permitted URL schemes, Redirect and DNS handling, Response returned to the caller, Egress network controls, Cloud instance metadata reachability, Internal services reachable from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because deny-lists lose to encoding tricks, decimal and IPv6-mapped addresses, DNS names that resolve to 169.254.169.254, and redirects added after validation. Resolving the host, checking the resolved IP against an allow-list and connecting to that pinned IP closes all of those at once.