Confirm SSRF vulnerabilities via out-of-band callbacks across URL-fetching endpoints.
npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-ssrf
Please help me install this Agent Skill. Skill: hunt-ssrf Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/hunt-ssrf Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill hunt-ssrf
Eliminates false positives in SSRF hunting by enforcing out-of-band proof, then helps you systematically find high-impact SSRF sinks and validate real network reachability.
Use case example: If a web app supports “link preview” or “URL import,” use this skill to confirm SSRF via a unique OOB marker and then determine whether it reaches cloud metadata, internal APIs, or headless-rendering network contexts.
Use the hunt-ssrf skill to validate SSRF on your target by planting an OOB callback, sending a URL/payload into the suspected preview or fetch parameter, and only reporting after a confirmed collaborator interaction.
High-intent search queries and answers about installing and using this skill.
Find SSRF sinks by testing common URL-fetching endpoints such as link preview, import, proxy, render, screenshot, export, and validate features. Additionally, test JavaScript-driven fetch contexts and redirect-following behaviors to identify where user-supplied URLs are processed server-side.
Demonstrate SSRF impact by chaining payloads to access cloud metadata services like GCP, AWS, or Azure metadata endpoints. Pivot through localhost or internal ports and use redirect bypasses to quantify the blast radius for triage-quality reporting.
Yes, out-of-band validation works for headless rendering and JavaScript fetch contexts. You plant an OOB callback URL into the suspected fetch parameter, and if the headless browser or JavaScript engine processes it, the collaborator interaction confirms the SSRF.
Structure SSRF reports by including unique OOB collaborator interactions as mandatory proof, documenting the discovered sink endpoint, detailing payload selection, and demonstrating chained impact like internal network reachability for reproducible triage-quality reporting.
ArianHobson333Detect Server-Side Request Forgery vulnerabilities via taint analysis of user-controlled URLs.
Kisilev13Generate bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.
BrownFineSecurityIdentify open ports and enumerate network services with Nmap.
roderikAnalyze API surfaces and configuration schemas to detect misuse-prone designs.
