skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

performing-blind-ssrf-exploitation

Identify and exploit blind SSRF vulnerabilities using out-of-band callbacks and timing analysis.

Updated Apr 23, 2026
Search Tags:#ssrf#security-testing#internal-network#cloud-metadata#blind-ssrf#oob-detection
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-blind-ssrf-exploitation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-blind-ssrf-exploitation
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-blind-ssrf-exploitation
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-blind-ssrf-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Blind SSRF vulnerabilities allow attackers to access internal networks and cloud metadata endpoints without visible responses. This Skill provides a structured approach to detect and exploit such weaknesses using out-of-band callbacks, timing analysis, and internal service enumeration.

Core Features & Use Cases

  • Detect blind SSRF via out-of-band callbacks (DNS/HTTP) and timing-based techniques.
  • Enumerate internal services and access cloud metadata endpoints in controlled environments.
  • Generate machine-readable results and human-readable findings for security assessments.

Quick Start

Provide a target URL and parameter to initiate blind SSRF testing and collect OOB indicators for reporting.

Frequently Asked Questions about performing-blind-ssrf-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect blind SSRF vulnerabilities without visible responses?▼

Identify blind SSRF using out-of-band DNS or HTTP callbacks and timing analysis. This approach confirms internal network access and cloud metadata endpoint interaction even when the application provides no visible response.

What is the best way to test for cloud metadata endpoint exposure during security assessments?▼

Test cloud metadata endpoints using structured payload lists during security assessments. This enumerates accessible internal services and generates machine-readable outputs suitable for red-team engagement reporting.

Can I use Python requests for out-of-band detection and internal service enumeration?▼

Yes, you can use Python requests for out-of-band detection. The implementation relies on the requests library to deliver payloads and collect OOB indicators for internal service identification.

How do I exploit blind SSRF to enumerate internal networks in a controlled environment?▼

Enumerate internal networks via blind SSRF by injecting targeted payloads and monitoring OOB callbacks. This scouts internal services and maps network topology through machine-readable findings.

What are the limitations of timing analysis for blind SSRF detection?▼

Timing analysis for blind SSRF detection is limited by network latency and asynchronous processing, which can cause false positives. Combine timing techniques with out-of-band callbacks for reliable vulnerability confirmation.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-ssrf

Detects SSRF vulnerabilities in web applications using OOB callbacks and metadata probes.

Community
Advanced
YukiIto1999YukiIto1999

performing-firmware-malware-analysis

Automate firmware malware analysis to identify backdoors and unauthorized modifications.

Community
Advanced
narlyseorgnarlyseorg
6

recon-and-enumeration

Automate reconnaissance and enumeration of endpoints, services, and technologies.

Community
Advanced
utsavthakurutsavthakur

ssrf-server-side-request-forgery

Identify and exploit SSRF vulnerabilities using cloud metadata endpoints and payloads.

Community
Advanced