Probe URL parameters with SSRF payloads to access internal services.
npx skills add https://github.com/devtint/API_PENTEST --skill ssrf-testing-devtint
Please help me install this Agent Skill. Skill: ssrf-testing Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/ssrf-testing Command: npx skills add https://github.com/devtint/API_PENTEST --skill ssrf-testing-devtint
This Skill identifies and exploits Server-Side Request Forgery (SSRF) vulnerabilities, allowing access to internal services and sensitive data that would otherwise be unreachable.
Use the ssrf-testing skill to probe the 'url' parameter on the target API for SSRF vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To test APIs for Server-Side Request Forgery (SSRF), this skill identifies URL parameters and probes them with crafted payloads to access internal services and cloud metadata endpoints. It requires an out-of-band callback server to confirm vulnerabilities.
Yes, bypassing SSRF filters is possible using techniques like IP encoding and protocol smuggling. This skill probes target parameters with these specific payloads to circumvent restrictions and successfully reach internal services or sensitive data.
The best way to access cloud metadata endpoints through SSRF is probing API URL parameters that fetch external resources. This skill sends crafted requests to these parameters, aiming to reach internal cloud metadata and reveal sensitive data.
Yes, you need an out-of-band callback server for confirming SSRF detection. This skill requires an external interaction client to receive callbacks, verifying that the target server processed the crafted payloads and successfully reached the internal network.
An API becomes vulnerable to internal network access attacks when it allows users to input URLs for fetching external resources without proper validation. This SSRF vulnerability can be abused to make the server request internal resources, revealing IPs or credentials.
enderphan94Orchestrate vulnerability agents to assess web surfaces and verify findings via HTTP and OOB channels.
dreadnodeGenerates IP encoding variants to bypass string-based SSRF validation filters.
chainreactorsAutomate network reconnaissance to identify live hosts, open ports, and service fingerprints.
zebbernAutomate red-team reconnaissance and vulnerability discovery workflows.
