SSRF Local File Read via Anomalous Large Response on URL-Fetching Endpoint

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.