Detecting Server-Side Request Forgery (SSRF) Vulnerabilities In REST API Fuzz Testing (SBFT 2026)

Who

Susruthan Seran , Guru Bhandari, Andrea Arcuri

Track

SBFT 2026

Time Zone

The program is currently displayed in (GMT-03:00) Brasilia, Distrito Federal, Brazil.

Use conference time zone: (GMT-03:00) Brasilia, Distrito Federal, BrazilSelect other time zone

The GMT offsets shown reflect the offsets at the moment of the conference.

Time Band

By setting a time band, the program will dim events that are outside this time window. This is useful for (virtual) conferences with a continuous program (with repeated sessions).
The time band will also limit the events that are included in the personal iCalendar subscription service.

Display full programSpecify a time band

Save

When

Sun 12 Apr 2026 12:00 - 12:20 at Oceania IV - Paper Presentation

Abstract

The entangled internet reveals more vulnerable situations in modern interconnected software systems. Among these, Server-Side Request Forgery (SSRF) is one marked as a top ten vulnerability to look for in the OWASP Top 10 rankings. There has been a significant amount of work in academia to detect SSRF.

In this paper, we present our novel techniques for detecting SSRF in REST APIs, utilizing search-based techniques in a fully automated manner. Our work offers a unique language-agnostic approach, which can be adapted into other software fuzzers for both white-box and black-box contexts.

Susruthan Seran

Guru Bhandari

Andrea Arcuri

Kristiania University College and Oslo Metropolitan University

Norway