Detect and validate SSRF vulnerabilities with out-of-band confirmation.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-ssrf-uphiago
Please help me install this Agent Skill. Skill: hunt-ssrf Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-ssrf Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-ssrf-uphiago
SSRF vulnerabilities allow attackers to trick servers into making unauthorized outbound network requests, enabling access to internal services, cloud metadata endpoints, and sensitive infrastructure that is not exposed externally. This Skill eliminates the guesswork of identifying and validating SSRF flaws, which are high-severity risks often missed during standard reconnaissance.
Use the hunt-ssrf skill to test the target's link preview endpoint for SSRF by sending an out-of-band callback URL and confirming the server makes an unauthorized outbound request to internal cloud metadata services.
High-intent search queries and answers about installing and using this skill.
Detect blind SSRF vulnerabilities by sending an out-of-band callback URL to the target server and confirming the server-initiated request reaches your listener. Mandatory out-of-band confirmation eliminates false positives from URL echo bugs and parser-only validation.
Yes, you can extract AWS IMDS, GCP, and Azure metadata credentials via SSRF. By tricking the server into requesting cloud metadata endpoints, you can retrieve IAM credentials to assess full account compromise risk.
Effective SSRF filter bypass techniques include DNS rebinding, IP encoding, and protocol confusion to circumvent IP blocklists, schema restrictions, and redirect validators. These methods help reach internal resources despite input filters.
Enumerate internal networks via SSRF by scanning internal ports and accessing unauthenticated services like Redis and Elasticsearch. You can also map Kubernetes clusters by leveraging server-initiated requests to internal service endpoints.
Yes, this methodology targets URL-fetching features like link previews, file imports, webhooks, and PDF generators. These services are highly susceptible to SSRF because they require server-side outbound network requests to process URLs.
sseshachalaIdentify XXE vulnerabilities in XML parsers via inline and DTD payloads.
langbyyiDetect and exploit SSRF vulnerabilities in web applications and cloud services.
anton-abyzovDeploy and operate Apache Kafka on Kubernetes with Strimzi or Confluent Operator.
ArianHobson333Detects SSRF vulnerabilities via out-of-band requests and cloud metadata checks.
