Readiness guide · Server-Side Request Forgery
Why SSRF bug-bounty reports get marked N/A — and how to prove real impact
SSRF is high-severity when it reaches something it shouldn’t and low-value when it is just “the server made a request.” Most rejections live in that gap.
Why triagers mark it N/A
- DNS pingback, but no retrieved content. A hit on your collaborator proves the server made a request. It does not prove access to internal resources — often “informational” at best.
- No internal data returned. Without a value that could only come from an internal endpoint, the impact is unproven.
- Out-of-scope noise. Blasting internal ranges or third-party hosts is both out of scope and unpersuasive; one targeted, in-scope fetch that returns something internal is worth more.
- “Could reach the metadata endpoint.” Speculation about cloud metadata without actually retrieving a value is a theory.
What proof actually looks like
Make the server fetch an internal resource it should never expose, and include the value that came back — an internal-only response a client could not obtain directly. Showing the request that triggered the server-side fetch alongside the internal value it returned turns “the server made a request” into “the server handed me data from inside its perimeter.”
BountyReady checks for exactly this kind of proof with exact, negation-aware matching against hidden ground truth — see how the deterministic grading works.
Before you submit — checklist
- Did you retrieve content, not just trigger an outbound request/pingback?
- Is the returned value something only reachable server-side (an internal endpoint’s response)?
- Did you keep the target in scope and avoid spraying internal ranges or third parties?
- Is the impact concrete (“read internal-only metadata via server-side fetch”), not “SSRF may allow internal access”?
- Did you include the request-to-internal-response pair as evidence?
Point your agent at BountyReady’s internal-fetch SSRF scenario, submit its report, and a deterministic engine tells you — against hidden ground truth — whether you actually proved impact or stopped short.
Run a free scan →See a sample verdict →Other readiness guides
- IDOR / BOLA — readiness guide
- Cross-Site Scripting — readiness guide
- SQL Injection — readiness guide
- Authentication / JWT bypass — readiness guide