How SSRF works
Your URL, the server's network position. That asymmetry is the bug.
SSRF hands attacker-chosen URLs to server-side fetching: image proxies, webhooks, file imports, PDF generators. The server dutifully requests whatever it is told — including addresses you could never reach yourself, because the request now originates inside the target's own network.
The prizes are positional. Loopback reaches admin panels bound to localhost. Link-local addresses reach cloud metadata services that hand out credentials for the machine's role. Internal hostnames resolve to databases, queues, and dashboards never exposed publicly. Each is reachable only because the fetch runs with the server's network view.
Defense is egress control plus input discipline: allowlists of fetchable hosts and schemes, blocking private and link-local ranges after DNS resolution (not before — rebinding rotates answers), and disabling redirects to attacker-influenced locations.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.