skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-ssrf

Validates SSRF vulnerabilities via OOB callbacks, cloud metadata probes, and internal service checks.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#pentesting#ssrf#cloud-security#oob
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-ssrf-salmanabdurrahman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-ssrf
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-ssrf
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-ssrf-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured, authorized, and safe methodology for identifying Server-Side Request Forgery (SSRF) vulnerabilities, preventing unauthorized access to internal networks and cloud metadata services.

Core Features & Use Cases

  • Blind SSRF Detection: Uses OOB (out-of-band) callbacks to confirm server-side requests without needing direct response visibility.
  • Cloud Metadata Validation: Safely probes for cloud environment exposure (AWS, GCP, Azure) without extracting sensitive credentials.
  • Internal Service Probing: Confirms reachability of internal network services using safe, non-destructive connection tests.

Quick Start

Use the vuln-ssrf skill to initiate a blind SSRF probe against the target parameter using your configured OOB listener.

Frequently Asked Questions about vuln-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely check for blind SSRF vulnerabilities using an OOB listener?▼

To check for blind SSRF safely, you test URL-fetching parameters against a configured OOB listener to confirm server-side requests without needing direct response visibility.

Can I test for cloud metadata endpoint exposure without extracting credentials?▼

Yes, you can validate cloud metadata exposure for AWS, GCP, and Azure environments by using safe, gated probes that confirm reachability without extracting sensitive credentials.

What is the safest way to probe internal network services for SSRF?▼

The safest way to probe internal network services for SSRF is by using non-destructive connection tests that confirm reachability while adhering to strict scope definitions and authorization checks.

Do I need authorization checks before testing server-side request forgery risks?▼

Yes, verifying server-side request forgery risks requires strict adherence to scope definitions, documented safety protocols, and explicit authorization checks to prevent service disruption or credential exfiltration.

When should I use out-of-band callbacks for pentesting network-level exposure?▼

You should use out-of-band callbacks for pentesting network-level exposure when you lack direct response visibility and need to safely confirm that the server is making external requests.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-ssrf

Detects SSRF vulnerabilities in web applications using OOB callbacks and metadata probes.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-ssrf-metadata-pivot

Trace SSRF reachability from sources to internal metadata endpoints.

Community
Advanced
asdfgh1445asdfgh1445
735

Strix•SSRF 测试

Identify SSRF attack surfaces in web applications and cloud environments.

Community
Intermediate
florianbuetowflorianbuetow
12

ssrf

Analyze source code for SSRF vulnerabilities and cloud metadata endpoint risks.

Community
Advanced