What problem does it solve? SSRF is a low-cost, high-impact vulnerability class, but blind SSRF is frequently misreported because error messages and status-code differences look like confirmation when they are not. This Skill provides a disciplined hunting methodology that separates real server-side fetches from false positives and escalates confirmed bugs toward cloud credential impact. ## Core Features & Use Cases - Signal-based detection: Identifies SSRF-prone parameters (url, callback, webhook_url, avatar_url) and functional patterns like link previews, PDF rendering, and low-code API debuggers. - OOB confirmation gate: Enforces dnslog/interactsh callback verification with per-sink subdomains, plus official SRC intranet targets (JD, Baidu, Tencent, ByteDance, Meituan) as authoritative proof. - Cloud metadata exploitation: Provides payload tables for AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud IMDS endpoints, including IMDSv2 token handling and CAM credential paths. - Bypass variants: Covers decimal/hex/octal IP encodings, IPv6 mapping, DNS rebinding, 302 redirect chains, and short-link bypasses for blacklist-filtered targets. - Use Case: During authorized SRC testing, you find an avatar upload feature accepting a URL. You plant a tagged dnslog callback, confirm the server-side fetch, then retrieve Tencent Cloud CAM temporary credentials via the metadata endpoint and stop to report at credential tier. ## Quick Start Use the hunt-ssrf skill to test this target's URL-fetching parameters for SSRF, confirm any hits with OOB callbacks, and check cloud metadata endpoints for credential exposure.
