Skip to main content

01. Validating SSRF Quickly with OAST

When you identify a possible SSRF sink, the key is to check immediately whether it produces outbound DNS or HTTP traffic. OAST (Out-of-Band Application Security Testing) works by triggering an external request and observing its trace, leaving evidence even when a WAF or filter blocks the visible response.

Minimal practical flow​

  • Issue a unique subdomain and prepare a tokenized URL such as abc.oast.me.
  • Try scheme variants such as http(s)://, gopher://, and ftp:// to bypass filters.
  • Even with an empty response, a DNS lookup log is evidence of possible SSRF.

CTF and authorized-testing tips​

  • When assessing internal reachability, first determine whether metadata endpoints such as http://169.254.169.254 are accessible.
  • Redirect chains can reveal weaknesses in allowlist enforcement.
  • Evaluate a blocking rule by the outbound trace, not only whether the request returned a visible success.

In short, prove SSRF through outbound activity rather than the response. OAST logs provide the fastest evidence.