Classificador de URL para SSRF
Cole uma URL e veja para onde ela realmente aponta: loopback, uma faixa privada ou link-local, um endpoint de metadados de nuvem, CGNAT, qualquer bloco dos registros de uso especial da IANA ou a internet pública. Ofuscação de IP em decimal, octal e hexadecimal é decodificada, assim como um endereço IPv4 escondido dentro de um IPv6 (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo); esquemas perigosos e credenciais embutidas são sinalizados, e um nível de risco de SSRF é exibido. Nunca resolve DNS e nunca envia a requisição.
Segurança e WAFTudo é calculado no seu navegador. Esta ferramenta nunca resolve DNS e nunca envia a requisição; ela classifica o endereço apenas a partir do texto que você cola.
The classifier decides purely from the URL string and never touches the network: it does not resolve DNS and never issues the request (D-53). It extracts the host from the raw input (not from a normalizing URL parser, which would erase the obfuscation), decodes the inet_aton spellings of an IPv4 address (decimal, octal, hex, short-form), normalises every IPv6 spelling to its RFC 5952 form, and decodes the IPv4 address carried inside six IPv6 layouts: IPv4-mapped (::ffff:0:0/96), the deprecated IPv4-compatible ::a.b.c.d, NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), 6to4 (2002::/16) and Teredo (2001::/32, whose server address and XOR-obfuscated client address are both shown, the more internal one deciding). Every one of the 25 IPv4 and 25 IPv6 rows of the IANA Special-Purpose Address Space registries (read 2026-10-19) is matched most specific first and rated by its own name and Globally Reachable flag: not globally reachable rates reserved unless the row is loopback, private, link-local or CGNAT; globally reachable rates public but is named, and the anycast service addresses (192.0.0.9, 192.0.0.10, 2001:1::1, 2001:1::2, 2001:1::3, and the 6a44 relay 192.88.99.2) are flagged as such. The cloud metadata addresses (169.254.169.254, metadata.google.internal, fd00:ec2::254, 100.100.100.200) outrank their covering rows. Dangerous non-HTTP schemes (file, gopher, dict, ftp, ldap, and similar) and embedded credentials are flagged. The range definitions come from the IANA registries and the RFCs they cite, the SSRF guidance from the OWASP SSRF prevention cheat sheet; behavior is pinned by 113 golden vectors.
- RFC 1918: Address Allocation for Private Internetsprivate IPv4 ranges
- RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses169.254.0.0/16 link-local
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space100.64.0.0/10 CGNAT
- RFC 3986: Uniform Resource Identifier (URI): Generic SyntaxURL structure
- OWASP: Server Side Request Forgery Prevention Cheat SheetSSRF defenses
- IANA: IPv4 Special-Purpose Address Spaceall 25 rows, read 2026-10-19 (registry updated 2025-10-09)
- IANA: IPv6 Special-Purpose Address Spaceall 25 rows, read 2026-10-19 (registry updated 2025-10-09)
- RFC 4291: IP Version 6 Addressing Architecturetext forms, IPv4-compatible and IPv4-mapped addresses
- RFC 6052: IPv6 Addressing of IPv4/IPv6 TranslatorsNAT64 address layouts
- RFC 4380: TeredoTeredo address format and client obfuscation