saas-provider-url-ssrf

What problem does it solve?

This Skill solves the problem of identifying and exploiting two-phase stored SSRF vulnerabilities in SaaS platforms that allow administrators to configure external provider URLs for integrations such as SSO, VCS, OAuth, SAML, and SCIM, where server-side fetches are triggered by separate downstream flows rather than at configuration time.

Core Features & Use Cases

• Two-Phase Attack Workflow: Guides users through the full stored SSRF process, from identifying persisted URL configuration fields to triggering server-side fetches via separate downstream flows with different authentication levels.
• Multi-Integration Coverage: Includes specific trigger details for common SaaS integrations including OIDC SSO, GitHub Enterprise Server, SAML, SCIM, webhooks, and Databricks OAuth.
• Impact Validation & Authorization Testing: Provides methods to confirm SSRF impact via out-of-band callbacks and internal service timing oracles, plus guidance to test for lower-privilege attack surfaces to assess full risk severity.
• Real-World Use Case: A security tester assessing a corporate SaaS platform's SSO integration can use this Skill to store an attacker-controlled out-of-band callback URL in the OIDC issuer configuration, then trigger the SSO login flow to confirm the server makes a request to the malicious endpoint.

Quick Start

Use this skill to test a target SaaS platform's configurable SSO, VCS, or OAuth integrations for two-phase SSRF vulnerabilities by identifying stored URL fields, deploying an out-of-band callback server, and triggering the relevant server-side fetch flow.