What problem does it solve? SSRF findings are frequently rejected at triage because hunters claim blind SSRF without proof that the server actually made an outbound request. This Skill enforces an out-of-band confirmation workflow and provides tested payloads for cloud metadata, internal services, and filter bypasses so reports survive triage. ## Core Features & Use Cases - OOB-First Validation Gate: Requires Burp Collaborator or interactsh callbacks with per-parameter payload isolation before any SSRF claim is made, including negative controls for attribution. - Cloud Metadata Payloads: Ready-to-use targets for AWS IMDSv1, GCP metadata.google.internal, Azure IMDS, and Kubernetes service account tokens, plus localhost port enumeration for Redis, etcd, Elasticsearch, and Consul. - Bypass Technique Library: Covers blocklist bypasses (decimal/hex/octal IPs, IPv6 mapping, DNS rebinding, URL parser confusion), redirect-chain bypasses, gopher-to-Redis RCE chains, and base64/double-encoding filter evasion. - Use Case: While testing a link-preview API on a cloud-hosted SaaS target, plant a unique Collaborator payload in the url parameter, confirm the callback, then pivot to http://169.254.169.254/latest/meta-data/ to demonstrate credential exposure with full attribution evidence. ## Quick Start Ask the AI to test a specific URL-accepting endpoint on your authorized bug bounty target for SSRF using an interactsh callback and the cloud metadata payload checklist.
