What problem does it solve? When a CTF or sandbox challenge hinges on a server-side request forgery primitive, it is easy to stop at proving internal reachability and miss the decisive step: turning that reachability into extracted credentials that a downstream service actually accepts. This Skill structures the full SSRF-to-accepted-access chain so no critical evidence or pivot step is skipped. ## Core Features & Use Cases - SSRF Source Mapping: Records the fetch primitive, URL construction, normalization rules, redirect handling, and header behavior before any mutation. - Metadata Credential Pivoting: Traces metadata endpoints, token fields, role scope, and service-account credentials through to the service that accepts them. - Decisive Chain Reduction: Compresses findings into a minimal SSRF source to internal target to credential to accepted replay path, distinguishing read-only reachability from real privilege. - Use Case: During a cloud-themed CTF challenge, you find an image-fetcher parameter that fetches arbitrary URLs. Use this Skill to probe the link-local metadata endpoint, extract a service-account token, and prove the token is accepted by an internal API. ## Quick Start Ask the assistant to trace the SSRF source in the challenge, probe reachable metadata endpoints, and prove the extracted token is accepted by a downstream service.
