exploiting-server-side-request-forgery

Name: exploiting-server-side-request-forgery
Availability: InStock
Author: balsm-health

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

2|Updated Jun 5, 2026

Search Tags:#penetration testing #web security #vulnerability testing #cloud security #ssrf #internal network scanning

Ready to run

npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-server-side-request-forgery

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: exploiting-server-side-request-forgery
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/exploiting-server-side-request-forgery
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-server-side-request-forgery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, SSRFmap, interactsh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the identification and exploitation of Server-Side Request Forgery (SSRF) vulnerabilities in authorized penetration tests, saving time and effort in security assessments.

Core Features & Use Cases

Automated SSRF Identification: Scans applications for SSRF vulnerabilities and provides detailed reports.
Cloud Metadata Access: Exploits SSRF to access cloud metadata services for credentials and configuration information.
Internal Network Scanning: Discovers internal services and ports via SSRF.
Filter Bypassing: Includes techniques to bypass SSRF filters and allowlists.
Blind SSRF Detection: Identifies SSRF where the response is not returned to the attacker.
Use Case: A penetration tester can use this Skill to automate the discovery of SSRF vulnerabilities in a web application during a security audit.

Quick Start

Use the ssrf skill to scan for SSRF vulnerabilities in the web application at 'https://target.example.com'.

Frequently Asked Questions about exploiting-server-side-request-forgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate SSRF vulnerability testing during a web application penetration test?▼

Automating SSRF vulnerability testing involves scanning web applications to identify Server-Side Request Forgery flaws and exploiting them to access internal services. This Skill streamlines that process for authorized security assessments using automated scanning techniques.

Can I access cloud metadata credentials using an SSRF vulnerability?▼

Yes, exploiting SSRF vulnerabilities can access cloud metadata services to extract credentials and configuration information. This Skill automates the extraction of sensitive cloud metadata during authorized penetration tests.

What is blind SSRF detection and how does it identify internal network services?▼

Blind SSRF detection identifies vulnerabilities where the application server makes external requests without returning the response to the attacker. This Skill uses out-of-band techniques to discover internal services and ports via SSRF.

Do I need SSRFmap and interactsh to test for Server-Side Request Forgery?▼

Yes, SSRFmap and interactsh are required dependencies for testing. SSRFmap handles the exploitation and internal network scanning, while interactsh facilitates out-of-band communication for blind SSRF detection.

How to bypass SSRF filters and allowlists during web security testing?▼

Bypassing SSRF filters involves using techniques like URL encoding, DNS rebinding, and IP format variations to circumvent allowlist restrictions. This Skill includes filter bypassing methods to test robust web application security controls.