What problem does it solve? When a client reaches backends only through a proxy that fetches HMAC-signed, base64-encoded target URLs, testers often stop at "the URL is integrity-protected" and miss the real bugs. This Skill provides a methodology for attacking that indirection: finding endpoints that sign attacker input, detecting signer-versus-fetcher normalization mismatches, and proving whether any of it produces actual SSRF impact. ## Core Features & Use Cases - Corpus harvesting and decoding: Decode pre-signed proxy URLs from discovery/config endpoints and inspect signature structure (version byte, key id, HMAC shape) to confirm keys are not forgeable offline. - Signing oracle discovery: Hunt unauthenticated endpoints whose responses contain freshly signed proxy URLs, then probe how much of the signed URL (path vs host) attacker input controls. - Normalization mismatch testing: Compare fetcher behavior across encoded payloads (%2F, %252F, overlong UTF-8, null bytes) against a baseline to prove the signer and fetcher disagree on the URL. - False-positive discipline: Requires every apparent success to be compared against direct access to the same target, so path manipulation that reaches nothing new is not reported as SSRF. - Use Case: During a fintech web assessment, you find /api/inviter/<slug> returning signed proxy URLs; use this methodology to test host-escape payloads, detect double-decoding at the fetcher, and correctly conclude no impact when traversal only reaches already-public hosts. ## Quick Start Analyze the signed proxy URLs from my target's discovery endpoint and test whether the signing oracle lets me escape the host or reach internal services.
