skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

2|Updated Jun 5, 2026
Search Tags:#penetration testing#web security#vulnerability testing#cloud security#ssrf#internal network scanning
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-server-side-request-forgery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-server-side-request-forgery
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/exploiting-server-side-request-forgery
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-server-side-request-forgery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, SSRFmap, interactsh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the identification and exploitation of Server-Side Request Forgery (SSRF) vulnerabilities in authorized penetration tests, saving time and effort in security assessments.

Core Features & Use Cases

  • Automated SSRF Identification: Scans applications for SSRF vulnerabilities and provides detailed reports.
  • Cloud Metadata Access: Exploits SSRF to access cloud metadata services for credentials and configuration information.
  • Internal Network Scanning: Discovers internal services and ports via SSRF.
  • Filter Bypassing: Includes techniques to bypass SSRF filters and allowlists.
  • Blind SSRF Detection: Identifies SSRF where the response is not returned to the attacker.
  • Use Case: A penetration tester can use this Skill to automate the discovery of SSRF vulnerabilities in a web application during a security audit.

Quick Start

Use the ssrf skill to scan for SSRF vulnerabilities in the web application at 'https://target.example.com'.

Frequently Asked Questions about exploiting-server-side-request-forgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SSRF vulnerability testing during a web application penetration test?▼

Automating SSRF vulnerability testing involves scanning web applications to identify Server-Side Request Forgery flaws and exploiting them to access internal services. This Skill streamlines that process for authorized security assessments using automated scanning techniques.

Can I access cloud metadata credentials using an SSRF vulnerability?▼

Yes, exploiting SSRF vulnerabilities can access cloud metadata services to extract credentials and configuration information. This Skill automates the extraction of sensitive cloud metadata during authorized penetration tests.

What is blind SSRF detection and how does it identify internal network services?▼

Blind SSRF detection identifies vulnerabilities where the application server makes external requests without returning the response to the attacker. This Skill uses out-of-band techniques to discover internal services and ports via SSRF.

Do I need SSRFmap and interactsh to test for Server-Side Request Forgery?▼

Yes, SSRFmap and interactsh are required dependencies for testing. SSRFmap handles the exploitation and internal network scanning, while interactsh facilitates out-of-band communication for blind SSRF detection.

How to bypass SSRF filters and allowlists during web security testing?▼

Bypassing SSRF filters involves using techniques like URL encoding, DNS rebinding, and IP format variations to circumvent allowlist restrictions. This Skill includes filter bypassing methods to test robust web application security controls.

Related Skills

EntroVyxEntroVyx
3

web-pentest

Perform authorized web application penetration testing with proof-based exploitation.

Community
Advanced
uphiagouphiago
1.1k

hunt-host-header

Identify and validate host header injection vulnerabilities in web applications.

Community
Advanced
YukiIto1999YukiIto1999

performing-blind-ssrf-exploitation

Identify and exploit blind SSRF vulnerabilities using out-of-band callbacks and timing analysis.

Community
Advanced
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced