SSRF Risk Calculator

Score server-side request forgery risk from URL handling, redirect and DNS behaviour, egress controls and cloud metadata reachability.

About SSRF Risk Calculator

Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials. SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.

Formula

SSRF Risk

Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface).

urlSource: 1 fixed constant … 9 fully user-supplied
metadata: 2 blocked … 9 IMDSv1 reachable
internalSurface: Blast radius reachable from the host

Worked example

With the default values below, SSRF Risk Calculator returns Overall Risk Severity of Critical. Change any input above and every figure here is recalculated in your browser.

Inputs used

Where the outbound URL comes fromone of A fixed internal constant — 1, Chosen from a server-side allow-list — 2, User-supplied with a deny-list — 7, Fully user-supplied — 9: Fully user-supplied — 9
Permitted URL schemesone of https only — 2, http and https — 5, Any scheme including file and gopher — 9: http and https — 5
Redirect and DNS handlingone of Resolve once, pin the IP, block redirects — 1, Re-validate the target after each redirect — 4, Follows redirects unchecked — 9: Follows redirects unchecked — 9
Response returned to the callerone of Nothing echoed, fully blind — 4, Status code and timing only — 6, Full response body echoed — 9: Status code and timing only — 6
Egress network controlsone of Deny-by-default egress proxy — 1, Allow-list firewall — 3, Link-local range blocked only — 6, Unrestricted egress — 9: Link-local range blocked only — 6
Cloud instance metadata reachabilityone of Metadata blocked at the host — 2, IMDSv2 enforced — 4, IMDSv2 optional — 6, IMDSv1 reachable — 9: IMDSv1 reachable — 9
Internal services reachable from the hostone of Isolated egress-only subnet — 3, Same application tier — 5, Shared VPC including data stores — 7, Management network and Kubernetes API — 9: Shared VPC including data stores — 7

Results

Overall Risk Severity: Critical
Likelihood Score: 7.25 / 9
Impact Score: 7.33 / 9
Risk Score: 5.91 / 9
Cloud Credential Theft Path: Open — IMDSv1 hands out role credentials to a single GET
Highest-Value Fix: Replace the deny-list with a server-side allow-list of hosts

Step by step

1Values used
2SSRF Risk
3Overall Risk Severity= Critical
4Likelihood Score= 7.25 / 9
5Impact Score= 7.33 / 9
6Risk Score= 5.91 / 9
7Cloud Credential Theft Path= Open — IMDSv1 hands out role credentials to a single GET
8Highest-Value Fix= Replace the deny-list with a server-side allow-list of hosts

Assumptions and limits

The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is SSRF Risk calculated?

Likelihood = mean(URL source, permitted schemes, redirect and DNS handling, response echo); impact = mean(egress controls, metadata reachability, internal attack surface). Likelihood covers whether an attacker can steer the request and see the answer — a blind SSRF is materially harder to exploit than one that echoes the body. Impact is blast radius: what the host can reach on the network and whether the cloud metadata service will hand over role credentials.

Why does SSRF Risk matter?

SSRF is the standard first move in cloud breaches because one unauthenticated fetch can return IAM credentials, and the fix is a network control rather than a code change.

What values do I need to enter?

This calculator takes 7 inputs: Where the outbound URL comes from, Permitted URL schemes, Redirect and DNS handling, Response returned to the caller, Egress network controls, Cloud instance metadata reachability, Internal services reachable from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is an allow-list the only reliable defence?

Because deny-lists lose to encoding tricks, decimal and IPv6-mapped addresses, DNS names that resolve to 169.254.169.254, and redirects added after validation. Resolving the host, checking the resolved IP against an allow-list and connecting to that pinned IP closes all of those at once.