hunt-ssrf

Name: hunt-ssrf
Availability: InStock
Author: pdparchitect

Identify and validate SSRF vulnerabilities using out-of-band confirmation techniques.

13|2|Updated Jun 1, 2026

Search Tags:#security #vulnerability #cloud security #pentesting #ssrf #bug bounty

Ready to run

npx skills add https://github.com/pdparchitect/rook --skill hunt-ssrf-pdparchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ssrf
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-ssrf
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-ssrf-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of Server-Side Request Forgery (SSRF), where applications are tricked into making unauthorized requests to internal or cloud-based resources.

Core Features & Use Cases

Vulnerability Hunting: Identifies URL-input parameters and potential SSRF sinks across web applications and APIs.
Validation & Confirmation: Provides a rigorous methodology for confirming blind SSRF using out-of-band (OOB) techniques like Burp Collaborator or interactsh.
Cloud & Internal Recon: Specifically targets cloud metadata services (AWS, GCP, Azure) and internal infrastructure (Kubernetes, Redis, internal APIs) to demonstrate impact.

Quick Start

Use the hunt-ssrf skill to audit the target endpoint for SSRF vulnerabilities by testing the url parameter with an out-of-band callback.

Frequently Asked Questions about hunt-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect and validate SSRF vulnerabilities in web applications?▼

Blind SSRF vulnerabilities are confirmed using out-of-band (OOB) techniques like Burp Collaborator or interactsh to systematically verify network interactions and quantify the blast radius of potential exploits.

Does this SSRF testing methodology target AWS, GCP, and Azure cloud metadata services?▼

You can test internal infrastructure by targeting Kubernetes clusters, Redis instances, and internal APIs to demonstrate unauthorized data access or remote code execution resulting from SSRF vulnerabilities.

What is the best way to confirm blind SSRF during a security audit?▼

When auditing cloud-native infrastructure, you should target cloud metadata services and internal APIs to demonstrate unauthorized data access or remote code execution resulting from SSRF vulnerabilities.

Can I hunt for SSRF vulnerabilities across both APIs and cloud-native infrastructure?▼

Identifying SSRF vulnerabilities involves analyzing URL-input parameters and potential SSRF sinks across web applications and APIs to prevent unauthorized requests to internal or cloud-based resources.