Ssrf To Internal Service Breach

---
name: ssrf-to-internal-service-breach
description: Escalate a suspected or confirmed Server-Side Request Forgery into proof of internal-service access — cloud metadata, internal-only APIs, database greetings, or redacted-but-fetchable HTTP. Use when a parameter takes a URL (image proxy, webhook, fetcher, URL preview, PDF render) and the server reaches outbound on your behalf, or when an audit finding tags CWE-918. Confirms reachability via OAST, then walks targeted internal endpoints, ending with a finding sized by the highest-value asset reached.
license: MIT
allowed-tools:
  - query_records
  - inspect_record
  - replay_request
  - send_raw_http
  - oast_mint
  - oast_poll
  - attack_kit
  - report_finding
  - update_finding
  - remember
  - update_plan
---

# SSRF → Internal Service Breach

You have a parameter or endpoint that makes the server fetch a URL of
your choosing. Your job is to prove the server reaches an internal
target you, the external user, can't. Persist a finding sized by what
you actually reached, not by the existence of the SSRF.

## When this skill applies

- A request parameter is a URL: `?url=`, `?image=`, `?webhook=`,
  `?callback=`, `?fetch=`, `?source=`, `?preview=`.
- An endpoint clearly fetches on behalf of the user: PDF renderers,
  link preview / OG-tag fetchers, OAuth callback verifiers, image
  thumbnailers, RSS importers, SSO redirect handlers.
- The response includes a fetched body excerpt, content-length, status,
  error string, or response time that varies with the URL you supply.
- Audit finding: CWE-918.

## Workflow

### 1. Confirm outbound reachability

Mint a canary with `oast_mint` (kind: `ssrf-probe`). Inject the canary
URL into the suspect parameter via `replay_request`. Poll with
`oast_poll` for 30-60 seconds.

- **HTTP callback observed** → server reaches your URL via HTTP. SSRF
  confirmed with HTTP egress.
- **DNS callback only** → SSRF confirmed but DNS-only (a strict egress
  filter dropped the HTTP request after the lookup). Still useful as
  exfil channel, but limits what you can do.
- **No callback** → either no SSRF, or filtered, or no internet egress
  from the server. Move to step 2's targeted probes anyway — some SSRFs
  only work against internal hosts.

`remember` the result as `ssrf-egress`.

### 2. Probe metadata services

Cloud metadata is the highest-impact target. Try in order; stop on the
first hit:

- **AWS IMDS v1**: `http://169.254.169.254/latest/meta-data/`
- **AWS IMDS v2** (token-flow): if v1 returns 401, you need a PUT to
  `/latest/api/token` first — most basic SSRFs can't do that, so skip.
- **GCP**: `http://metadata.google.internal/computeMetadata/v1/`
  (needs header `Metadata-Flavor: Google`; some SSRFs let you set
  extra headers via the URL fragment or a chained redirect).
- **Azure**: `http://169.254.169.254/metadata/instance?api-version=2021-02-01`
  (needs `Metadata: true` header).
- **DigitalOcean**: `http://169.254.169.254/metadata/v1/`
- **Alibaba**: `http://100.100.100.200/latest/meta-data/`

Look in the response for `iam/security-credentials/` (AWS), `project/`
(GCP), `instance/` (Azure). Credentials in metadata = critical
finding immediately.

### 3. Probe internal hosts and ports

If metadata doesn't reach (private cluster, no cloud), pivot to common
internal services. Use the URL parameter to hit `http://127.0.0.1:<port>/`
and `http://localhost:<port>/`:

- 6379 — Redis (try `info` via gopher://, or just observe greeting).
- 5432 — PostgreSQL (TLS handshake byte vs HTTP 400 distinguishes).
- 27017 — MongoDB (no HTTP, but error message differs).
- 9200 / 9300 — Elasticsearch (returns JSON cluster info on `/`).
- 8500 — Consul (`/v1/agent/self`).
- 6443 / 10250 — Kubernetes API / kubelet (often `Unauthorized` but
  reachable confirms exposure).
- 8080, 8081, 9090, 3000 — common dev/internal admin panels.

For TCP-only services (Redis, Postgres), `send_raw_http` lets you send
raw bytes if the SSRF supports `gopher://` or `dict://` schemes — most
do not. If only HTTP works, just confirming a 4xx/5xx with a
service-specific error string is enough to size the exposure.

### 4. Probe internal HTTP services and admin panels

`oast_mint` records prior crawls' hostnames. If you've seen
`internal.app.local`, `admin.staging`, `prometheus`, `grafana`,
`vault`, `consul` in any prior `query_records` output, try them via
the SSRF. Note the response.

### 5. Extract one credential / one config

If metadata or an admin panel returned data, extract ONE concrete
high-value item:

- One IAM access key + secret (AWS / GCP).
- One database connection string from a config endpoint.
- One service token from `/vault/v1/...` or `/api/admin/users/me`.
- One Kubernetes service account token.

Mask the secret in the finding (`AKIA****...****ABCD`). **Do not use
the credential.** Reaching it is the proof; the next step (using it)
is post-engagement work, not part of the audit.

### 6. Persist the finding

`report_finding`:

- `severity`:
  - `critical` if you reached cloud metadata credentials, a service
    token, or a database with admin connectivity.
  - `high` if you reached an internal HTTP service or admin panel.
  - `medium` if SSRF is confirmed (OAST callback) but every internal
    target was filtered.
- `title`: name the worst asset reached: `"SSRF in image-proxy reaches
  AWS IMDS; leaks IAM role credentials"`.
- `cwe_id`: CWE-918.
- `description`: 3-4 sentences — the parameter, the egress confirmation
  (HTTP callback observed), the highest-value internal target reached,
  and one masked sample of what was extracted.

## Pitfalls

- Some apps fetch via a sandboxed worker (Lambda, Cloud Run); the
  metadata may belong to the worker, not the main app — still a
  finding, just scope the title accordingly.
- DNS rebinding attacks can bypass IP-based filters that allow only
  public IPs; if a literal `169.254.169.254` is blocked, try a
  rebinding domain — but only with operator authorization (it
  involves outside infra).
- A response that "echoes the fetched body back to you" is great; one
  that "just returns 200/OK with no body" is harder to size — fall
  back to time-based / OAST-based confirmation.
- gopher:// / dict:// are blocked by most modern HTTP clients (Go's
  net/http, Node fetch). Don't burn time on gopher unless the target
  is on libcurl / PHP.

## Output expectations

- One `report_finding` per SSRF, severity matching what you reached.
- A `remember` note with the egress proof and the highest-value
  request used (key: `ssrf-proof`).
- Plan item marked `done`.