skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

ssrf-server-side-request-forgery

Detect and validate SSRF vulnerabilities in server-side URL fetch paths.

241|28|Updated May 20, 2026
Search Tags:#ssrf#cloud metadata#gopher#dns rebinding#blind ssrf#internal network discovery#url filter bypass
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill ssrf-server-side-request-forgery-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssrf-server-side-request-forgery
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/ssrf-server-side-request-forgery
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill ssrf-server-side-request-forgery-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

SSRF playbooks help you detect, validate, and systematically abuse server-side URL fetching so you can identify access to internal networks, cloud metadata services, and secondary protocols even when defenses attempt hostname or IP filtering.

Core Features & Use Cases

  • SSRF surface discovery: identify hidden URL-fetch parameters and less-obvious vectors such as PDF/screenshot generation, import/export via URL, and XML/GraphQL link-style fetches.
  • Blind SSRF confirmation: validate out-of-band callbacks with Burp Collaborator-style interactions, and use timing/error differences when content does not render.
  • Filter bypass & internal targeting: apply localhost/169.254 bypass families, DNS rebinding (TTL/TOCTOU), and URL parser confusion to reach cloud IMDS endpoints or internal services.
  • Protocol and cloud metadata exploitation: target AWS/GCP/Azure/Kubernetes/Alibaba/OCI metadata endpoints and extend impact via protocol abuse patterns such as gopher to reach raw TCP services.
  • Chaining guidance: load companion scenario studies to follow real-world CVE chains and SSRF-to-RCE exploitation patterns.

Quick Start

Provide the vulnerable parameter name and the target base URL to an AI using the instruction: “Run an SSRF first-pass confirmation for this endpoint, including filter bypass attempts for localhost and 169.254.169.254, and then expand to cloud metadata and blind OOB detection using a collaborator URL.”

Frequently Asked Questions about ssrf-server-side-request-forgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I confirm blind SSRF when the server response does not reflect fetched content?▼

Blind SSRF confirmation validates out-of-band callbacks using collaborator interactions and timing or error differences when fetched content does not render in the application response.

What is the best way to bypass URL filter defenses to reach cloud metadata services?▼

Bypassing URL filter defenses to reach cloud metadata involves applying localhost and 169.254 bypass families, DNS rebinding with TTL manipulation, and URL parser differentials.

How do I exploit SSRF to access internal network services using the gopher protocol?▼

Exploiting SSRF to access internal network services via the gopher protocol involves secondary-protocol abuse patterns to reach raw TCP services and extend impact beyond HTTP fetches.

Can I use this SSRF playbook to target AWS, GCP, Azure, and Kubernetes metadata endpoints?▼

Yes, the SSRF playbook targets AWS, GCP, Azure, Kubernetes, Alibaba, and OCI metadata endpoints by providing concrete endpoint catalogs and operational decision workflows for exploitation.

How do I discover hidden SSRF attack surface beyond standard URL parameters?▼

SSRF surface discovery identifies hidden URL-fetch vectors in less-obvious application features such as PDF generation, screenshot rendering, import/export functionality, and XML or GraphQL link fetches.

What is DNS rebinding and how does it bypass hostname filtering in server-side request forgery?▼

DNS rebinding bypasses hostname filtering by exploiting time-of-check to time-of-use vulnerabilities through DNS TTL manipulation, resolving to internal IPs after initial allowlist validation.

Related Skills

Explore More Legal & Compliance Skills→
Prohao42Prohao42
120

open-redirect

Identify open redirect vulnerabilities by analyzing URL parameters and sinks.

Community
Advanced
utsavthakurutsavthakur

ssrf-server-side-request-forgery

Identify and exploit SSRF vulnerabilities using cloud metadata endpoints and payloads.

Community
Advanced
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-ssrf

Map URL parameters and confirm SSRF sinks via out-of-band callbacks.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced