ssrf-server-side-request-forgery

Identify and exploit SSRF vulnerabilities using cloud metadata endpoints and payloads.

Updated Jun 11, 2026

Search Tags:#security #exploitation #CVE #ssrf #cloud metadata

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill ssrf-server-side-request-forgery-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssrf-server-side-request-forgery
Source: https://github.com/utsavthakur/agenticskills/tree/main/ssrf-server-side-request-forgery
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill ssrf-server-side-request-forgery-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill is designed to identify and exploit server-side request forgery (SSRF) vulnerabilities in a server, providing expert-level attack techniques and real-world scenarios.

Core Features & Use Cases

Expert SSRF Techniques: Covers advanced SSRF techniques such as URL filter bypass, cloud metadata endpoints, and protocol exploitation.
Real-World CVE Chains: Offers deep dives into CVE cases, including WebLogic SSRF (CVE-2014-4210), Kubernetes SSRF (CVE-2020-8555/CVE-2020-8562), and SSRF + Gopher Protocol.
Quick Start: Provides a quick guide to confirming SSRF and exploiting internal services.

Quick Start

Use the 'ssrf-server-side-request-forgery' skill to test for SSRF by supplying a parameter that fetches a URL and check if the server initiates an outbound connection.

Frequently Asked Questions about ssrf-server-side-request-forgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for SSRF vulnerabilities on a server?▼

To test for SSRF, supply a parameter that fetches a URL and check if the server initiates an outbound connection. This confirms the server processes external URLs, allowing further exploitation of internal services.

What are common SSRF bypass techniques for URL filters?▼

SSRF bypass techniques include manipulating URL syntax, exploiting alternative protocols like Gopher, and targeting cloud metadata endpoints. These methods evade basic input filters to reach restricted internal network resources.

How does SSRF interact with cloud metadata endpoints?▼

SSRF interacts with cloud metadata endpoints by forcing the server to fetch internal IP addresses. This exposes sensitive cloud instance credentials and configuration data without direct network access.

Can I exploit internal services using the SSRF Gopher protocol?▼

Yes, the Gopher protocol enables deep exploitation of internal services via SSRF. It allows crafting arbitrary TCP packets to interact with internal ports like Redis or MySQL for remote code execution.

Are there real-world CVE examples for server-side request forgery?▼

Real-world CVE examples include WebLogic SSRF (CVE-2014-4210) and Kubernetes SSRF (CVE-2020-8555/CVE-2020-8562). These demonstrate complex attack chains leveraging server-side request forgery to compromise cloud infrastructure.

What is the best way to confirm a server-side request forgery vulnerability?▼

The best way to confirm an SSRF vulnerability is injecting an outbound URL parameter into the target server. Monitoring for that server initiating the connection validates the vulnerability before attempting deeper exploitation.