SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity

SSRF in APIs: Six URL-Accepting Parameter Types and the IMDSv1/IMDSv2 Decision That Determines Severity In March 2025, a single threat actor made 69,433 probes across servers using six parameter names: url, dest, file, redirect, target, uri. The target was always the same: 169.254.169.254. No zero-day was involved. Every parameter tested ships in...