Post
Mostafa Moradian
mosi.bsky.social
did:plc:geidjc3tqjwm2h3ffflusnwf
Most SSRF bugs aren’t a missing check. The check looks at the URL string while the connection goes somewhere else: a hex IP, an IPv4-mapped IPv6 address, or a hostname that resolves to 10.0.0.5 the second time.
ressrf checks where it matters: after DNS & before connect.
https://github.com/timescale/ressrf
2026-10-21T13:16:36.138Z