skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

ssrf

Guide SSRF exploitation across HTTP, HTTPS, file, gopher, and dict protocols.

253|37|Updated Feb 22, 2026
Search Tags:#penetration testing#ssrf#vulnerability exploitation#server-side request forgery#cloud metadata#gopher
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill ssrf-blacklanternsecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssrf
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/ssrf
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill ssrf-blacklanternsecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities, enabling access to internal services, cloud metadata, and potentially leading to Remote Code Execution (RCE).

Core Features & Use Cases

  • SSRF Detection & Exploitation: Guides users through identifying injection points and testing various SSRF payloads.
  • Filter Bypass Techniques: Provides methods to circumvent common SSRF filters (IP encoding, DNS rebinding, redirects).
  • Cloud Metadata Access: Facilitates access to sensitive cloud provider metadata (AWS, GCP, Azure).
  • Protocol Exploitation: Demonstrates exploitation via gopher:// and dict:// for services like Redis and FastCGI.
  • Blind SSRF: Offers strategies for exploiting SSRF when direct responses are not available.
  • Use Case: When a web application accepts a URL parameter that is fetched server-side, this Skill can be used to probe internal network services, access cloud instance metadata, or even achieve RCE by exploiting vulnerable internal applications.

Quick Start

Use the ssrf skill to scan localhost for open ports.

Frequently Asked Questions about ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit server-side request forgery vulnerabilities to access internal services?▼

To exploit server-side request forgery (SSRF), you identify URL injection points in web applications and test payloads to fetch internal resources. This Skill guides probing localhost services and accessing restricted internal networks via HTTP and HTTPS protocols.

What is the best way to bypass SSRF filters blocking internal IP addresses?▼

Bypassing SSRF filters involves techniques like IP encoding, DNS rebinding, and URL redirects. This Skill provides methods to circumvent common input validation restrictions, allowing you to successfully route server-side requests to targeted internal addresses.

Can I use the gopher protocol to achieve RCE through SSRF?▼

Yes, you can use the gopher protocol during SSRF exploitation to interact with internal services like Redis and FastCGI. This Skill demonstrates how leveraging gopher:// and dict:// protocols can potentially lead to Remote Code Execution.

How do I access AWS, GCP, or Azure cloud metadata using SSRF?▼

Accessing cloud metadata via SSRF involves directing the vulnerable server to fetch cloud provider metadata endpoints. This Skill facilitates extracting sensitive credentials and instance data from AWS, GCP, and Azure environments.

What techniques work for blind SSRF when the server returns no direct response?▼

Blind SSRF exploitation requires strategies like out-of-band testing when direct responses are unavailable. This Skill offers specific techniques to infer vulnerabilities and interact with internal services without receiving direct HTTP responses.

Related Skills

Explore More Software Engineering Skills→
asdfgh1445asdfgh1445
735

Strix•SSRF 测试

Identify SSRF attack surfaces in web applications and cloud environments.

Community
Intermediate
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
blacklanternsecurityblacklanternsecurity
253

pivoting-tunneling

Establish SSH, Ligolo-ng, Chisel, socat, and DNS/ICMP tunnels through compromised hosts.

Official
Advanced
vitoropereiravitoropereira

Cross-Site Scripting and HTML Injection Testing

Detect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.

Community
Advanced