skills.rest
ersinkoc
ersinkocCOMMUNITY
Explore all skills by this author →
Website𝕏@ersinkocGitHub

sc-ssrf

Detect SSRF vulnerabilities in user-controlled URLs and HTTP request patterns.

56|5|Updated Apr 8, 2026
Search Tags:#security#input-validation#web-security#scanning#vulnerability-detection#ssrf#url-parameters
One-click install
npx skills add https://github.com/ersinkoc/security-check --skill sc-ssrf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sc-ssrf
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-ssrf
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-ssrf

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SSRF vulnerabilities allow attackers to manipulate server-side HTTP requests via user-controlled input. This skill helps teams detect and reason about SSRF risks in code paths, configurations, and deployed environments.

Core Features & Use Cases

  • Detects direct SSRF, blind SSRF, DNS rebinding, and partial SSRF through URL manipulation.
  • Applies during code reviews, security testing, and runtime monitoring to identify vulnerable endpoints.
  • Use case: In CI pipelines, scan APIs to surface endpoints that fetch remote URLs from user input and validate them.

Quick Start

Run an SSRF scan across your web application to identify endpoints that use user-supplied URLs and validate them.

Frequently Asked Questions about sc-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect SSRF vulnerabilities in web applications and APIs?▼

Detect SSRF vulnerabilities by analyzing user-controlled URLs and HTTP request patterns during code review or CI checks. This process surfaces direct, partial, and blind SSRF scenarios by tracking unsafe remote fetch operations in web applications and APIs.

What is DNS rebinding and how is it identified during security scanning?▼

DNS rebinding is an SSRF risk where domain resolution changes between validation and the actual HTTP request. Security scanning identifies this by analyzing URL parameters and setting detection thresholds for dynamic DNS behaviors to prevent unauthorized internal access.

Can I use this to scan for cloud metadata endpoint exposure in my codebase?▼

Yes, you can scan your codebase for cloud metadata endpoint exposure. The detection logic specifies thresholds for identifying when user-supplied URLs might target internal cloud metadata endpoints, providing guidance for safe remediation.

What is the best way to prevent blind SSRF through URL manipulation in APIs?▼

Prevent blind SSRF by validating user-supplied URLs and analyzing HTTP request patterns in your APIs. Applying input validation and scanning endpoints during CI checks surfaces vulnerable paths and provides safe remediation guidance against URL manipulation.

Does this SSRF detection approach work for runtime security checks?▼

Yes, this SSRF detection approach works for runtime security checks. It applies runtime monitoring to identify vulnerable endpoints by analyzing user-controlled URLs and HTTP request patterns as they occur in deployed web environments.

Related Skills

Explore More Software Engineering Skills→
dungsnowaxedungsnowaxe

ssrf-testing

Detect SSRF vulnerabilities by testing user-controlled URL inputs against internal services and cloud metadata endpoints.

Community
Advanced
Zenobia000Zenobia000
2

security-review

Identify and mitigate security vulnerabilities in application code across full-stack workflows.

Community
Advanced
IndustrialIndustrial

code-reviewer

Analyze code for security vulnerabilities and performance issues.

Community
Advanced
yhy0yhy0
518

ssrf

Detect and exploit server-side request forgery vulnerabilities in URL parameters.

Community
Advanced