• Check for paramters that has url
  • Append Burp collaborator link in the host header
  • Test for SSRF on functions that accept external resources
  • Use this cheatsheet for potentials ssrf : https://cheatsheetseries.owasp.org/assets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet_SSRF_Bible.pdf
  • Add img tag or iframe tag pointing to your domain when html is allowed
  • Test for function that allow external images
  • Add %0a as bypass or %00
  • Test SSRF on svg uploads
  • Test in webhooks