skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ssrf

Tests web applications for Server-Side Request Forgery vulnerabilities using structured checklists and bypass techniques.

Updated Sep 17, 2026
Search Tags:#vulnerability assessment#penetration testing#web security#ssrf#bug bounty#cloud metadata#dns rebinding
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill ssrf-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssrf
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-ssrf
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill ssrf-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers and bug bounty hunters need a systematic methodology to discover, confirm, and escalate Server-Side Request Forgery vulnerabilities without missing edge cases like blind SSRF, cloud metadata endpoints, or filter bypasses. ## Core Features & Use Cases - SSRF Discovery & Confirmation: Identify SSRF-prone parameters, set up out-of-band callback listeners (Burp Collaborator, Interactsh), and confirm basic, blind, and time-based SSRF. - Filter Bypass Techniques: Apply IP encoding variants (decimal, octal, hex, IPv6), DNS rebinding, URL parser confusion, open redirect chains, and Unicode tricks to evade allowlists and denylists. - Cloud & Kubernetes Escalation: Query AWS/GCP/Azure metadata endpoints (including IMDSv2 token flow), extract Kubernetes service account tokens, and pivot to internal services like Redis via Gopher. - Use Case: During a web app pentest, you find a PDF export feature that fetches URLs. Use this checklist to test internal addresses, bypass the IP filter with decimal encoding, reach the AWS metadata endpoint, and document a prioritized finding. ## Quick Start Ask Claude to walk through the SSRF testing checklist against your target endpoint, starting with discovery and callback listener setup.

Frequently Asked Questions about ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for SSRF vulnerabilities in a web application?▼

Start by mapping parameters that accept URLs (url, dest, redirect, callback, feed), then set up an out-of-band listener like Burp Collaborator or Interactsh. Submit internal addresses such as 127.0.0.1 and 169.254.169.254, and watch for response differences or callbacks confirming the server made the request.

How to detect blind SSRF when no response is returned?▼

Blind SSRF is detected through out-of-band channels: point the target at a unique URL on a server you control and check its logs for incoming requests. Time-based detection using delayed-response endpoints also reveals SSRF when content is never returned.

What techniques bypass SSRF allowlist and denylist filters?▼

Common bypasses include alternate IP representations (decimal 2130706433, octal, hex, IPv6 [::1]), URL encoding, open redirects on allowed domains, DNS rebinding with tools like rbndr.us or 1u.ms, and parser confusion such as http://[email protected].

Can SSRF access AWS metadata with IMDSv2 enabled?▼

IMDSv2 requires a PUT request to /latest/api/token to obtain a session token before metadata access. SSRF can still succeed if the vulnerable application forwards custom HTTP methods, supports method override headers, or proxies PUT requests through webhooks or API gateways.

When should SSRF testing not be performed?▼

SSRF testing should only run against systems you own or have explicit written authorization to test, such as scoped bug bounty programs. Testing cloud metadata endpoints or internal services without authorization can violate laws and provider terms of service.

Related Skills

Explore More Software Engineering Skills→
AKasem1AKasem1

web2-recon

Discover subdomains, live hosts, and actionable URLs for web2 vulnerability hunting.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
CleanExpoCleanExpo
1

input-sanitisation

Enforce OWASP Top 10 sanitisation patterns for Next.js and FastAPI applications.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

security

Scan code, containers, and infrastructure for security vulnerabilities.

Community
Advanced