URL Parser Confusion via At-Sign Userinfo Redirect to GCP Metadata Server

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors web and proxy traffic for patterns indicative of Server-Side Request Forgery (SSRF) attempts. It searches for specific URL parameters designed to manipulate requests toward internal cloud metadata services (e.g., 169.254.169.254), exploit protocol schemes like 'gcs://', or leverage URL parsing discrepancies such as unauthorized authority or fragment-at-sign confusion to bypass security filters.