ssrf

Identify and exploit SSRF vulnerabilities in web applications.

2.9k|469|Updated Mar 4, 2026

Search Tags:#security #vulnerability #penetration testing #web application #cloud security #ssrf

Ready to run

npx skills add https://github.com/SnailSploit/Claude-Red --skill ssrf-snailsploit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ssrf
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-ssrf
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill ssrf-snailsploit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities, a critical security flaw that can lead to unauthorized access to internal systems and sensitive data.

Core Features & Use Cases

SSRF Discovery: Detects potential SSRF vectors in web applications.
Exploitation: Provides methods to bypass filters, access cloud metadata, and pivot to internal services.
Use Case: A penetration tester can use this Skill to systematically test a web application for SSRF flaws, potentially gaining access to internal network resources or cloud credentials.

Quick Start

Use the ssrf skill to test the provided URL for server-side request forgery vulnerabilities.

Frequently Asked Questions about ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is an SSRF vulnerability and how does it expose internal systems?▼

Server-Side Request Forgery (SSRF) is a web application vulnerability that allows attackers to induce the server to make requests to unauthorized internal resources. This can expose sensitive data and cloud credentials by accessing internal network services.

How do I detect blind SSRF in a web application?▼

Blind SSRF detection involves identifying potential request forgery vectors without direct output. This Skill provides systematic testing methods to confirm blind SSRF by analyzing out-of-band interactions and server response behaviors during penetration testing.

How do I bypass filters to access cloud metadata endpoints via SSRF?▼

To access cloud metadata endpoints, this Skill provides filter bypass techniques that circumvent input validation. It enables penetration testers to reach restricted cloud metadata services and extract sensitive credentials from internal environments.

Can I escalate SSRF vulnerabilities to remote code execution?▼

Yes, SSRF vulnerabilities can be escalated to remote code execution (RCE). This Skill outlines specific exploitation paths and pivot techniques that transition from basic request forgery to full RCE on targeted internal services.

Does this SSRF testing methodology work for bug bounty hunting?▼

This Skill utilizes a comprehensive methodology tailored for web app security testing and bug bounty hunting. It covers discovery, exploitation, and escalation paths systematically to identify SSRF flaws across diverse web applications.