web-vuln-ssrf

Detects SSRF vulnerabilities in web applications using OOB callbacks and metadata probes.

21|1|Updated Apr 12, 2026

Search Tags:#vulnerability #bypass #ssrf #recon #cloud metadata #oob

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-ssrf

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: web-vuln-ssrf
Source: https://github.com/woohyun212/security-skill/tree/main/web-vuln-ssrf
Command: npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-ssrf

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detecting Server-Side Request Forgery (SSRF) vulnerabilities, including bypassing IP blocklists and extracting cloud instance metadata.

Core Features & Use Cases

IP Bypass Techniques: 11 encoding formats and redirect chain methods to evade server-side filters.
Out-of-Band Validation: Automatic OOB callbacks via interactsh to confirm blind SSRF.
Internal Service & Cloud Metadata Access: Probes common internal services and AWS, GCP, Azure metadata endpoints for credential extraction and potential RCE.

Quick Start

Ask the AI to run the web‑vuln‑ssrf skill against a target URL to identify SSRF vectors and attempt metadata extraction.

Frequently Asked Questions about web-vuln-ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect blind SSRF vulnerabilities in web applications?▼

To detect blind SSRF vulnerabilities, you validate out-of-band callbacks via an interactsh listener to confirm if a server-side request was successfully triggered. This method identifies blind SSRF instances without visible responses from the target application.

What is the best way to bypass IP blocklists when testing for SSRF?▼

Bypassing IP blocklists for SSRF involves using 11 encoding formats and redirect chain methods to evade server-side filters. These techniques obscure the destination IP address, allowing requests to reach restricted internal services.

How can I extract cloud instance metadata through SSRF?▼

Extracting cloud instance metadata through SSRF requires probing AWS, GCP, and Azure metadata endpoints via URL-accepting parameters. This process attempts credential extraction and potential remote code execution on the targeted cloud environment.

Do I need an out-of-band listener to test for server-side request forgery?▼

Yes, you need an out-of-band listener and curl installed to test for server-side request forgery. You also require appropriate authorization to interact with the target and validate blind SSRF via OOB callbacks.

Why does SSRF scanning fail to access internal services on some servers?▼

SSRF scanning fails to access internal services when server-side IP filters block direct requests to internal addresses. You must apply IP bypass techniques like encoding formats and redirect chains to evade these restrictions.