SSRF describes situations where an application causes a request from a context different from the user’s. Analysis starts by modelling capabilities, not by testing destinations indiscriminately.
Origin and destination
Identify which component performs the request, which protocols it supports, how it resolves names and which networks it can reach.
Transformations
Normalisation, redirects and parsers may change how a destination is interpreted. Record every transformation before evaluating controls.
Impact
Impact depends on reachable resources and the identity used by the component, not only on the existence of an outbound request.