The story
An SSRF (server-side request forgery) makes a server fetch, on the attacker's behalf, resources it should never expose.
Here, an innocent page: type your name, get a nice PDF certificate. But the HTML renderer inserts whatever it is given without checking it, and fetches whatever it is asked for, internal network included. Enough to make the attack tangible in a few minutes.
What I did
- Express app with PDF rendering by wkhtmltopdf, vulnerable by design
- Demo script for a non-technical audience
- Public code, to run only in an isolated environment