blind-ssrf-chains

What problem does it solve?

Blind SSRF vulnerabilities are often dismissed as low-severity because testers cannot view response bodies from internal hosts, making it impossible to demonstrate tangible impact like data theft or remote code execution to earn bug bounties or justify remediation.

Core Features & Use Cases

• Constraint Assessment: First maps the exact capabilities of the SSRF primitive (protocol support, port access, redirect following, etc.) to avoid wasting effort on non-viable attack chains.
• Canary-Based Verification: Uses out-of-band callbacks to confirm internal service presence and exploitability without relying on visible SSRF responses.
• Chained Exploitation Workflows: Provides step-by-step guidance for escalating blind SSRF to high-impact outcomes including Redis RCE via cron injection, Docker API container takeover, Jenkins pre-auth script execution, and cloud metadata credential theft.
• Use Case: Ideal for red teamers and penetration testers working on blind SSRF findings that require proof of CIA impact beyond simple internal host reachability.

Quick Start

Use the blind-ssrf-chains skill to escalate a confirmed blind SSRF vulnerability to proven impact by first assessing your SSRF primitive's constraints, fingerprinting reachable internal services via canary callbacks, and chaining attacks to achieve remote code execution or cloud credential theft.