skills.rest
mccleod1290
mccleod1290COMMUNITY
Explore all skills by this author →
GitHub

ssrf

Tests web applications for Server-Side Request Forgery using a structured checklist of discovery, bypass, and escalation techniques.

1|Updated Jul 2, 2026
Search Tags:#security testing#penetration testing#ssrf#bug bounty#cloud metadata#filter bypass#dns rebinding
One-click install
npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill ssrf-mccleod1290
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssrf
Source: https://github.com/mccleod1290/bb-agentic-setupv2/tree/main/web-skills/ssrf
Command: npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill ssrf-mccleod1290

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? It gives security testers a complete, ordered methodology for finding and exploiting Server-Side Request Forgery (SSRF) vulnerabilities, covering everything from initial discovery through blind SSRF detection, filter bypasses, and escalation to cloud metadata or internal service access. ## Core Features & Use Cases - SSRF Discovery & Confirmation: Identify URL-handling entry points (webhooks, importers, PDF generators, proxies), set up out-of-band callback listeners (Burp Collaborator, Interactsh), and confirm basic, blind, and time-based SSRF. - Filter Bypass Techniques: Bypass allowlists and denylists using alternate IP representations (decimal, octal, hex, IPv6), URL encoding, DNS rebinding, open redirects, parser confusion, and Unicode tricks. - Escalation & Exploitation: Access cloud metadata endpoints (AWS IMDSv2, GCP, Azure, DigitalOcean), abuse protocols (file, gopher, dict, ldap), perform internal port scanning, and pivot into Kubernetes, service mesh, and container runtime attack surfaces. - Use Case: During a bug bounty engagement, you find a URL preview feature. Use this checklist to test it for SSRF, detect a blind callback, bypass the IP filter with a decimal-encoded address, and retrieve AWS IAM credentials from the metadata service as proof of impact. ## Quick Start Ask the AI to test the target's URL-fetching endpoint for SSRF using this checklist, starting with a callback listener and common internal addresses.

Frequently Asked Questions about ssrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for SSRF vulnerabilities in a web application?▼

Identify parameters accepting URLs or hostnames, set up a callback listener like Burp Collaborator or Interactsh, then submit internal addresses such as 127.0.0.1 and 169.254.169.254. Confirm SSRF through response content, timing differences, or callbacks to your listener.

How to detect blind SSRF when no response is returned?▼

Use an out-of-band callback server such as Burp Collaborator, Interactsh, or canarytokens.org and supply its unique URL to the vulnerable parameter. Check your server logs for incoming requests from the target, and compare behavior across different hosts and ports.

What techniques bypass SSRF filters and allowlists?▼

Common bypasses include alternate IP representations (decimal 2130706433, octal, hex), IPv6 variants, URL encoding, open redirects on allowed domains, DNS rebinding with tools like rbndr.us or 1u.ms, and parser confusion with embedded credentials or backslashes.

Can SSRF access AWS metadata with IMDSv2 enabled?▼

Yes, if the application lets the SSRF issue a PUT request to /latest/api/token with the TTL header to obtain a session token, then passes that token in X-aws-ec2-metadata-token. This works when the server-side HTTP client honors method parameters or method-override headers.

What tools are used for SSRF testing?▼

The methodology references Burp Suite extensions (Collaborator, Param Miner, Turbo Intruder), specialized tools like SSRFmap, Gopherus, and Interactsh, plus network utilities such as Netcat, TCPDump, and Wireshark for callback detection and analysis.

When should I use ssrf-pipeline instead of this checklist?▼

This skill is a single-pass checklist for one testing session. For a deep multi-phase SSRF sweep across a large attack surface, the documentation directs you to the ssrf-pipeline skill instead.

Related Skills

Explore More Software Engineering Skills→
AKasem1AKasem1

web2-recon

Discover subdomains, live hosts, and actionable URLs for web2 vulnerability hunting.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
pdparchitectpdparchitect
13

hunt-ssrf

Identify and validate SSRF vulnerabilities using out-of-band confirmation techniques.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced