skills.rest
yhy0
yhy0COMMUNITY
Explore all skills by this author →
Website𝕏@yhy_00GitHub

pentest-ssrf

Detect and exploit SSRF vulnerabilities in web applications during penetration tests.

74|10|Updated Mar 5, 2026
Search Tags:#penetration testing#web security#vulnerability detection#cloud security#network scanning#ssrf
One-click install
npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-ssrf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-ssrf
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/pentest-ssrf
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-ssrf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps security professionals identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities, a common and critical web security flaw.

Core Features & Use Cases

  • Attack Surface Discovery: Identifies common entry points and patterns for SSRF vulnerabilities in web applications.
  • Exploitation Techniques: Provides specific payloads and methods for exploiting SSRF, including accessing internal services, cloud metadata, and using various protocols.
  • Use Case: When performing a penetration test on a web application, use this Skill to systematically discover and test for SSRF vulnerabilities, potentially gaining access to internal systems or cloud credentials.

Quick Start

Use the pentest-ssrf skill to identify potential SSRF vulnerabilities by testing internal network addresses and cloud metadata endpoints.

Frequently Asked Questions about pentest-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is an SSRF vulnerability and how does it impact web security?▼

During a penetration test, this skill identifies SSRF entry points by testing internal network addresses and cloud metadata endpoints, providing specific payloads and methods for exploitation.

How do I exploit SSRF to access cloud metadata credentials?▼

To exploit SSRF for cloud metadata exfiltration, you target cloud metadata endpoints using crafted payloads. This skill provides specific techniques to access internal services and extract cloud credentials during penetration testing engagements.

Can I use this to test file and gopher protocol abuse in SSRF attacks?▼

Yes, you can test protocol abuse using file:// and gopher:// schemes. This skill guides the detection and exploitation of these protocols to assess server-side request forgery vulnerabilities and analyze real-world HackerOne cases.

What's the best way to discover SSRF attack surfaces in web applications?▼

The best way to discover SSRF attack surfaces is by identifying common entry points and patterns in web applications. This skill systematically analyzes potential vulnerabilities by testing internal network addresses and metadata endpoints.

Does this skill provide remediation strategies for Server-Side Request Forgery?▼

Yes, it provides remediation strategies for Server-Side Request Forgery. By analyzing real-world cases from HackerOne, it helps assess the impact of SSRF vulnerabilities and guides security professionals in implementing effective fixes.

Related Skills

Explore More Software Engineering Skills→
jayjpatel9717jayjpatel9717

ssrf-testing

Detect and classify SSRF vulnerabilities in web applications.

Community
Advanced
wuyoscarwuyoscar
934

cyber-scapy-recon

Generate PTES-compliant penetration test reports from Scapy engagement data.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
SkobynSkobyn

hunt-ssrf

Detect and exploit SSRF vulnerabilities in web applications.

Community
Advanced