SSRF Sentinel: Server-Side Request Forgery Defense

Every "fetch a URL for me" feature — image proxies, webhook senders, PDF renderers, link previews — is a potential Server-Side Request Forgery vector: an attacker who controls the URL can point the server at internal-only destinations, including the cloud metadata service that hands out IAM credentials with no authentication. This simulator fires seven realistic payloads, including numeric-IP obfuscation and DNS-rebinding bypasses, through four server-side validation modes and renders each request as a particle traveling from the client through a gateway checkpoint to its real destination — public internet, private network, or cloud metadata — so you can watch exactly where a naive blocklist or a parse-time-only allowlist lets a request slip past defenses that a connect-time re-resolve would have caught.