skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

blind-ssrf-chains

Assess blind SSRF constraints and verify internal services via canary callbacks.

11|1|Updated May 4, 2026
Search Tags:#penetration testing#red teaming#cloud metadata#blind ssrf#ssrf exploitation#canary detection#internal fingerprinting
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill blind-ssrf-chains
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: blind-ssrf-chains
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/blind-ssrf-chains
Command: npx skills add https://github.com/dreadnode/capabilities --skill blind-ssrf-chains

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Blind SSRF vulnerabilities are often dismissed as low-severity because testers cannot view response bodies from internal hosts, making it impossible to demonstrate tangible impact like data theft or remote code execution to earn bug bounties or justify remediation.

Core Features & Use Cases

  • Constraint Assessment: First maps the exact capabilities of the SSRF primitive (protocol support, port access, redirect following, etc.) to avoid wasting effort on non-viable attack chains.
  • Canary-Based Verification: Uses out-of-band callbacks to confirm internal service presence and exploitability without relying on visible SSRF responses.
  • Chained Exploitation Workflows: Provides step-by-step guidance for escalating blind SSRF to high-impact outcomes including Redis RCE via cron injection, Docker API container takeover, Jenkins pre-auth script execution, and cloud metadata credential theft.
  • Use Case: Ideal for red teamers and penetration testers working on blind SSRF findings that require proof of CIA impact beyond simple internal host reachability.

Quick Start

Use the blind-ssrf-chains skill to escalate a confirmed blind SSRF vulnerability to proven impact by first assessing your SSRF primitive's constraints, fingerprinting reachable internal services via canary callbacks, and chaining attacks to achieve remote code execution or cloud credential theft.

Frequently Asked Questions about blind-ssrf-chains

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I demonstrate impact for a blind SSRF vulnerability when I cannot see the response body?▼

To demonstrate impact for a blind SSRF vulnerability without response bodies, you can use out-of-band canary callbacks to verify internal service presence and then chain attacks against high-value targets like Redis or cloud metadata endpoints.

How do I escalate blind SSRF to remote code execution using internal services?▼

You can escalate blind SSRF to remote code execution by chaining exploitation workflows against internal services, such as executing Redis RCE via cron injection or taking over Docker API containers, verified through out-of-band callbacks.

What is the best way to assess SSRF primitive constraints before attempting exploitation?▼

The best way to assess SSRF primitive constraints is mapping exact capabilities like protocol support, port access, and redirect following, which avoids wasting exploitation effort on non-viable attack chains.

Can I steal cloud metadata credentials through a blind SSRF vulnerability?▼

Yes, you can steal cloud metadata credentials through a blind SSRF vulnerability by using chained exploitation workflows that target cloud metadata endpoints and confirm credential theft via out-of-band verification.

How do I fingerprint internal services during a blind SSRF assessment?▼

You can fingerprint internal services during a blind SSRF assessment by using canary-based out-of-band detection to confirm service presence and exploitability without relying on visible SSRF responses.

What internal services can be targeted for chained exploitation after confirming a blind SSRF?▼

After confirming a blind SSRF, high-value internal services targeted for chained exploitation include Redis for RCE via cron injection, Docker API for container takeover, Jenkins for pre-auth script execution, and cloud metadata endpoints.

Related Skills

Explore More Software Engineering Skills→
Pabloprogramador23Pabloprogramador23

reversa-scout

Map legacy project folders, languages, frameworks, dependencies, and entry points.

Community
Intermediate
AcczdyAcczdy
2

conducting-internal-network-penetration-test

Simulate internal network penetration tests to reveal lateral movement and privilege escalation paths.

Community
Advanced
sseshachalasseshachala

hunt-xxe

Identify XXE vulnerabilities in XML parsers via inline and DTD payloads.

Community
Advanced
securityfortechsecurityfortech
6

ssrf

Detect and exploit SSRF vulnerabilities in user-controlled URL inputs.

Official
Advanced