Question

Server-side request forgery ( SSRF) is a vulnerability that lets an attacker send requests on behalf of a server. During an SSRF, attackers forge the request signatures of the vulnerable server, allowing them to assume a privileged position on a network, bypass firewall controls, and gain access to internal services.

服务器端请求伪造（SSRF）是一种漏洞，能让攻击者代表服务器发送请求。在 SSRF 期间，攻击者伪造易受攻击的服务器的请求签名，使他们能够在网络上扮演特权角色，绕过防火墙控制，并访问内部服务。

In this chapter, we’ll cover how SSRF works, how to bypass common protections for it, and how to escalate the vulnerability when you find one.

在本章中，我们将介绍 SSRF 的工作原理，如何绕过常见的保护措施，以及在发现漏洞时如何升级漏洞。