Part 6: When “Fetch This URL” Becomes SSRF

AI generated image

That means the network may contain cloud-specific services that the user can’t access directly.

But I don’t jump straight to production infrastructure.

I use controlled internal endpoints to establish the boundary first.

For example:

internal-test-service
    |
    +-- identity test
    +-- network test
    +-- authorization test

If DevAssist can reach it while the user cannot, I have proven the network boundary.

Then I can work with the system owner to determine whether the reachable production services are expected to be accessible from the DevAssist runtime.

That’s a safer and cleaner way to establish impact than indiscriminately probing infrastructure.

I also test protocol restrictions

Suppose the product requirement says:

“DevAssist should fetch public HTTPS documentation.”

Then I test whether it actually enforces:

HTTPS only
Allowed ports
Allowed schemes
Allowed destinations
Maximum redirects
Response size
Timeout

For example, if the tool accepts:

http://...
https://...
file://...
ftp://...