skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-ssrf

Test URL-fetching endpoints for SSRF against internal infrastructure and cloud metadata services.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#cloud#pentest#ssrf#redteam
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ssrf-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ssrf
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-ssrf
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-ssrf-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and confirming Server-Side Request Forgery (SSRF) vulnerabilities, which are often misidentified or missed entirely due to complex network configurations and blind execution environments.

Core Features & Use Cases

  • OOB Confirmation: Enforces mandatory out-of-band (OOB) verification to prevent false positives from error-string echoes.
  • Cloud Metadata Testing: Provides specific payloads for AWS, GCP, and Azure metadata services to test for credential exfiltration.
  • Advanced Bypass Techniques: Includes methods for handling blocklists, DNS rebinding, and protocol smuggling to reach internal services.

Quick Start

Use the hunt-ssrf skill to perform a blind SSRF check on the target endpoint by providing your unique OOB collaborator domain.

Frequently Asked Questions about hunt-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for blind SSRF vulnerabilities in web applications?▼

Testing for blind SSRF involves routing payloads through an out-of-band collaborator to confirm server-side execution. This skill mandates OOB confirmation to validate vulnerabilities and eliminate false positives from error-string echoes.

Can I use SSRF payloads to extract AWS, GCP, and Azure cloud metadata credentials?▼

Yes, you can extract AWS, GCP, and Azure cloud metadata credentials. This skill provides specific payloads targeting cloud metadata services to test for credential exfiltration in cloud-hosted SaaS and microservice architectures.

What is the best way to bypass blocklists when testing for SSRF?▼

Bypassing blocklists during SSRF testing requires DNS rebinding and protocol smuggling techniques. This skill includes advanced methods to handle blocklists and reach internal services blocked by standard network configurations.

How do I validate SSRF findings without getting false positives from error strings?▼

Validating SSRF findings without false positives requires mandatory out-of-band verification. This skill enforces OOB confirmation to ensure high-confidence findings, preventing misidentification from error-string echoes in blind execution environments.

Does SSRF testing work against microservice architectures and internal network boundaries?▼

Yes, SSRF testing works against microservice architectures by systematically testing internal network boundaries. This skill applies to web applications and cloud-hosted SaaS where user-supplied URLs are processed server-side to identify unauthorized internal access.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

ssrf

Detect and exploit SSRF vulnerabilities in user-controlled URL inputs.

Official
Advanced
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
uphiagouphiago
1.1k

hunt-ssrf

Detect and validate SSRF vulnerabilities with out-of-band confirmation.

Community
Advanced
EntroVyxEntroVyx
3

security-arsenal

Provide offensive security payloads and bypass techniques for manual penetration testing.

Community
Advanced