skills.rest
bs-koo
bs-kooCOMMUNITY
Explore all skills by this author →
GitHub

detecting-ssrf-and-open-redirect

Detect SSRF and open redirect vulnerabilities in Spring and JSP web application source code.

Updated Jun 24, 2026
Search Tags:#static analysis#spring#vulnerability scanning#semgrep#ssrf#open redirect#jsp
One-click install
npx skills add https://github.com/bs-koo/gx-security --skill detecting-ssrf-and-open-redirect-bs-koo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-ssrf-and-open-redirect
Source: https://github.com/bs-koo/gx-security/tree/main/skills/detecting-ssrf-and-open-redirect
Command: npx skills add https://github.com/bs-koo/gx-security --skill detecting-ssrf-and-open-redirect-bs-koo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Web applications that pass user-supplied URLs into server-side HTTP clients or redirect destinations expose internal networks, cloud metadata endpoints, and users to phishing. This Skill finds those SSRF and open redirect weaknesses in SQIsoft Spring Boot and JSP/Servlet codebases before attackers exploit them. ## Core Features & Use Cases - Hybrid static scanning: Runs a Semgrep ruleset (rules/ssrf-redirect.yml) or a regex grep-fallback to flag RestTemplate, WebClient, HttpURLConnection, URL.openStream, sendRedirect, and "redirect:" + parameter patterns across both spring-modern and jsp-legacy stacks. - AI context verification: Traces each candidate's data flow to separate real vulnerabilities from false positives such as hardcoded redirect paths or fixed-domain API calls. - Standardized reporting: Produces a severity-ranked report with what is vulnerable, why, a conceptual proof of concept, and a concrete fix for each confirmed finding. - Use Case: Point it at a legacy JSP project where login redirects use a returnUrl parameter; it flags response.sendRedirect(request.getParameter("returnUrl")) as a confirmed open redirect and provides a relative-path-only fix. ## Quick Start Ask the AI to check the project at a given source path for SSRF and open redirect vulnerabilities, for example by saying to run the SSRF and open redirect scan on your Spring or JSP codebase.

Frequently Asked Questions about detecting-ssrf-and-open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect SSRF vulnerabilities in Java Spring code?▼

Scan for RestTemplate, WebClient, and HttpURLConnection calls whose URLs derive from user input such as @RequestParam values. This Skill runs Semgrep rules or a regex fallback to find candidates, then traces each URL's data flow to confirm whether user input controls the request target.

How to find open redirect vulnerabilities in JSP applications?▼

Look for response.sendRedirect or "redirect:" returns that consume parameters like returnUrl, next, or redirectUrl without validation. The scanner flags these patterns and marks hardcoded redirect paths as likely false positives for AI review.

Does the scanner work without Semgrep installed?▼

Yes, it falls back to regex-based grep scanning when Semgrep is unavailable. The fallback has lower recall, so a zero-result run does not guarantee safety, and the tool prints a warning in that case.

Why are some sendRedirect findings marked as false positives?▼

Redirects to hardcoded paths like sendRedirect(request.getContextPath() + "/login.do") contain no user input and are not exploitable. The scanner tags these as likely-fp, and the AI verification step excludes them from confirmed findings.

Can SSRF reach cloud metadata endpoints like 169.254.169.254?▼

Yes, if a server-side request uses an attacker-controlled URL, it can reach the AWS metadata endpoint and steal IAM credentials. The Skill checks whether internal IP ranges, localhost, and file:// schemes are blocked and whether host whitelisting exists.

Related Skills

Explore More Software Engineering Skills→
santosomarsantosomar
1

spring-mvc-to-boot-migrator

Convert Spring MVC XML configurations to Spring Boot Java-based configurations.

Community
Advanced
uphiagouphiago
1.1k

hunt-open-redirect

Identify and exploit open redirect vulnerabilities across web applications.

Community
Intermediate
petrogurcakpetrogurcak

security-review

Audit application code for OWASP Top 10 vulnerabilities.

Community
Advanced
Renzo-TognellaRenzo-Tognella

integrating-dast-with-owasp-zap-in-pipeline

Automate OZAP DAST scans in CI/CD pipelines with GitHub Actions or GitLab CI.

Community
Advanced