SSRF Discovery at Scale: A Multi-Program Study Using Automated Reconnaissance and

We present a large-scale automated study of Server-Side Request Forgery (SSRF) vulnerabilities across 23 major bug bounty programs using a structured pipeline combining reconnaissance automation, multi-endpoint probing, response classification, and LLM-enriched analysis via the Saif cybersecurity AI system. Over a two-week period, we probed 23 programs using three standardized SSRF test endpoints — /proxy?url=, /fetch?url=, and /redirect?url= — and classified responses on a five-tier severity scale: HTTP 308 (confirmed), 303 (strong), 302 (moderate), 301 (weak), and 403 (protected). Our pipeline identified confirmed or strong SSRF vulnerabilities in 5 of 23 programs, encompassing 13 distinct subdomains across Amazon/Wickr, Meta, MongoDB, Apple, and Shopify. The Saif LLM enrichment pipeline provided automated vulnerability assessment, report drafting, and severity estimation, generating a total estimated bounty range of $53,500–$198,000 across all findings. We detail the full methodology, per-program response tables, subdomain-level results, and the Saif integration pipeline that enabled end-to-end automation from subdomain discovery to report submission.