What it is
CSRF abuses the browser's habit of attaching credentials to any request to a site, so a page you control can act as the victim. SSRF abuses the server's position inside the network, turning it into your proxy to things you cannot reach from outside.
How I attack it
- For CSRF: strip the token and see if the endpoint still accepts the request. Then try a wrong token, an empty token, and another user's token.
- Check the method and content type - plenty of JSON endpoints happily accept a form post.
- For SSRF: anywhere the app fetches a URL is a candidate - webhooks, importers, PDF renderers, image proxies, link previews.
- Prove impact beyond a callback: cloud metadata, internal admin panels, ports that should not be reachable.
Learn it from The XSS Rat