Fantastic bit of research and write-up. SSRF is going to be the major story for the next couple years. I've seen them all over the place and they are much hard

Fantastic bit of research and write-up. SSRF is going to be the major story for the next couple years. I've seen them all over the place and they are much harder to block since they exploit multiple protocols and the properties of URLs have many arcane rules that aren't known to most programmers. Reading this a while back really opened my eyes to how complicated it was, even if I'd already learned (the hard way) most of it: http://www.skorks.com/2010/05/what-every-developer-should-know-about-urls/ http://www.skorks.com/2010/05/what-every-developer-should-kn...