performing-blind-ssrf-exploitation

Name: performing-blind-ssrf-exploitation
Availability: InStock
Author: YukiIto1999

Identify and exploit blind SSRF vulnerabilities using out-of-band callbacks and timing analysis.

Updated Apr 23, 2026

Search Tags:#ssrf #security-testing #internal-network #cloud-metadata #blind-ssrf #oob-detection

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-blind-ssrf-exploitation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: performing-blind-ssrf-exploitation
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-blind-ssrf-exploitation
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-blind-ssrf-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Blind SSRF vulnerabilities allow attackers to access internal networks and cloud metadata endpoints without visible responses. This Skill provides a structured approach to detect and exploit such weaknesses using out-of-band callbacks, timing analysis, and internal service enumeration.

Core Features & Use Cases

Detect blind SSRF via out-of-band callbacks (DNS/HTTP) and timing-based techniques.
Enumerate internal services and access cloud metadata endpoints in controlled environments.
Generate machine-readable results and human-readable findings for security assessments.

Quick Start

Provide a target URL and parameter to initiate blind SSRF testing and collect OOB indicators for reporting.

Frequently Asked Questions about performing-blind-ssrf-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect blind SSRF vulnerabilities without visible responses?▼

Identify blind SSRF using out-of-band DNS or HTTP callbacks and timing analysis. This approach confirms internal network access and cloud metadata endpoint interaction even when the application provides no visible response.

What is the best way to test for cloud metadata endpoint exposure during security assessments?▼

Test cloud metadata endpoints using structured payload lists during security assessments. This enumerates accessible internal services and generates machine-readable outputs suitable for red-team engagement reporting.

Can I use Python requests for out-of-band detection and internal service enumeration?▼

Yes, you can use Python requests for out-of-band detection. The implementation relies on the requests library to deliver payloads and collect OOB indicators for internal service identification.

How do I exploit blind SSRF to enumerate internal networks in a controlled environment?▼

Enumerate internal networks via blind SSRF by injecting targeted payloads and monitoring OOB callbacks. This scouts internal services and maps network topology through machine-readable findings.

What are the limitations of timing analysis for blind SSRF detection?▼

Timing analysis for blind SSRF detection is limited by network latency and asynchronous processing, which can cause false positives. Combine timing techniques with out-of-band callbacks for reliable vulnerability confirmation.