offensive-ssrf

Name: offensive-ssrf
Author: SnailSploit

2.8kstars447forks

How to install offensive-ssrf?

snailsploit/claude-red/offensive-ssrf

$npx -y skills add SnailSploit/Claude-Red --skill offensive-ssrf

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Server-Side Request Forgery (SSRF)
2
3	## Metadata
4	- Skill Name: ssrf
5	- Folder: offensive-ssrf
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/ssrf.md
7
8	## Description
9	Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`SSRF, server-side request forgery, blind SSRF, cloud metadata, AWS metadata, GCP metadata, SSRF bypass, DNS rebinding, redirect chain, SSRF RCE, internal port scan`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Server-Side Request Forgery (SSRF)
29
30	## Shortcut
31
32	- Spot the features prone to SSRF and take notes for future reference.
33	- Set up a callback listener to detect blind SSRF by using an online service, Netcat, or Burp's Collaborator feature.
34	- Provide the potentially vulnerable endpoints with common internal addresses or the address of your callback listener.
35	- Check if the server responds with information that confirms the SSRF. Or, in the case of a blind SSRF, check your server logs for requests from the target server.
36	- In the case of a blind SSRF, check if the server behavior differs when you request different hosts or ports.
37	- If SSRF protection is implemented, try to bypass it by using the strategies discussed in this chapter.
38	- Pick a tactic to escalate the SSRF.
39
40	```mermaid
41	flowchart LR
42	A[Identify SSRF Vectors] --> B[Setup Callback Listener]
43	B --> C[Test Internal Addresses]
44	C --> D{Response Contains\nInternal Data?}
45	D -->\|Yes\| E[Basic SSRF Confirmed]
46	D -->\|No\| F[Check Callback\nListener Logs]
47	F --> G{Callbacks\nReceived?}
48	G -->\|Yes\| H[Blind SSRF Confirmed]
49	G -->\|No\| I[Try Bypass Techniques]
50	I --> J[Retest with Bypasses]
51	E --> K[Escalate SSRF]
52	H --> K
53	J --> D
54	```
55
56	## Mechanisms
57
58	Server-Side Request Forgery (SSRF) is a vulnerability that allows attackers to induce a server-side application to make requests to an unintended location. In a successful SSRF attack, the attacker can force the server to connect to:
59
60	- Internal services within the organization's infrastructure
61	- External systems on the internet
62	- Services on the same server (localhost)
63	- Cloud service provider metadata endpoints
64
65	```mermaid
66	graph TD
67	A[Attacker] -->\|Sends crafted request\| B[Vulnerable Web App]
68	B -->\|Makes request to\| C[Unintended Target]
69	C -->\|Responds with data\| B
70	B -->\|Includes response data\| A
71
72	subgraph "Possible Targets"
73	C
74	D[Internal Network Services]
75	E[Cloud Metadata Service]
76	F[External Web Services]
77	G[Local Services on Same Server]
78	end
79
80	C --- D
81	C --- E
82	C --- F
83	C --- G
84	```
85
86	Types of SSRF include:
87
88	- Basic SSRF: Direct requests to internal/external resources
89	- Blind SSRF: No response returned, but requests still occur
90	- Semi-blind SSRF: Limited information returned in responses
91	- Time-based SSRF: Detection through response timing differences
92	- Out-of-band SSRF: Secondary channel used for data exfiltration
93
94	## Hunt
95
96	### Identifying SSRF Vectors
97
98	- URL Input Fields:
99	- Website preview generators
100	- Document/image imports from URLs
101	- API integrations with external services
102	- Webhook configurations
103	- Export to PDF/screenshot functionality
104
105	- Proxy Functionality:
106	- Web proxies
107	- Content fetchers
108	- API gateways
109	- Translation services
110
111	- File Processing:
112	- Media conversion tools
113	- Document processors
114	- XML/JSON processors with external entity support
115
116	- Integration Points:
117	- Third-party service connections
118	- Cloud storage integrations
119	- Monitoring systems
120	- Webhook endpoints
121
122	```mermaid
123	mindmap
124	root((SSRF Vectors))
125	URL Input Fields
126	Website Previews
127	URL Imports
128	API Integrations
129	Webhooks
130	PDF/Screenshot Export
131	Proxy Functionality
132	Web Proxies
133	Content Fetchers
134	API Gateways
135	Translation Services
136	File Processing
137	Media Converters
138	Document Processors
139	XML/JSON Processors
140	Integration Points
141	Third-party Services
142	Cloud Storage
143	Monitoring Systems
144	Webhook Endpoints
145	```
146
147	### Test Methodology
148
149	1. Identify Parameters: Find URL or hostname parameters
150	2. Setup Listener: Configure a system to detect callbacks
151	- Public server with unique URL
152	- Burp Collaborator
153	- Tools like Interactsh or canarytokens.org
154	3. Test Internal Access: Try a

People who liked this also viewed

6 picks

Type

offensive-ssrf

2.8kstars447forks

View on GitHub

How to install offensive-ssrf?

snailsploit/claude-red/offensive-ssrf

$npx -y skills add SnailSploit/Claude-Red --skill offensive-ssrf

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Server-Side Request Forgery (SSRF)
2
3	## Metadata
4	- Skill Name: ssrf
5	- Folder: offensive-ssrf
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/ssrf.md
7
8	## Description
9	Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`SSRF, server-side request forgery, blind SSRF, cloud metadata, AWS metadata, GCP metadata, SSRF bypass, DNS rebinding, redirect chain, SSRF RCE, internal port scan`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Server-Side Request Forgery (SSRF)
29
30	## Shortcut
31
32	- Spot the features prone to SSRF and take notes for future reference.
33	- Set up a callback listener to detect blind SSRF by using an online service, Netcat, or Burp's Collaborator feature.
34	- Provide the potentially vulnerable endpoints with common internal addresses or the address of your callback listener.
35	- Check if the server responds with information that confirms the SSRF. Or, in the case of a blind SSRF, check your server logs for requests from the target server.
36	- In the case of a blind SSRF, check if the server behavior differs when you request different hosts or ports.
37	- If SSRF protection is implemented, try to bypass it by using the strategies discussed in this chapter.
38	- Pick a tactic to escalate the SSRF.
39
40	```mermaid
41	flowchart LR
42	A[Identify SSRF Vectors] --> B[Setup Callback Listener]
43	B --> C[Test Internal Addresses]
44	C --> D{Response Contains\nInternal Data?}
45	D -->\|Yes\| E[Basic SSRF Confirmed]
46	D -->\|No\| F[Check Callback\nListener Logs]
47	F --> G{Callbacks\nReceived?}
48	G -->\|Yes\| H[Blind SSRF Confirmed]
49	G -->\|No\| I[Try Bypass Techniques]
50	I --> J[Retest with Bypasses]
51	E --> K[Escalate SSRF]
52	H --> K
53	J --> D
54	```
55
56	## Mechanisms
57
58	Server-Side Request Forgery (SSRF) is a vulnerability that allows attackers to induce a server-side application to make requests to an unintended location. In a successful SSRF attack, the attacker can force the server to connect to:
59
60	- Internal services within the organization's infrastructure
61	- External systems on the internet
62	- Services on the same server (localhost)
63	- Cloud service provider metadata endpoints
64
65	```mermaid
66	graph TD
67	A[Attacker] -->\|Sends crafted request\| B[Vulnerable Web App]
68	B -->\|Makes request to\| C[Unintended Target]
69	C -->\|Responds with data\| B
70	B -->\|Includes response data\| A
71
72	subgraph "Possible Targets"
73	C
74	D[Internal Network Services]
75	E[Cloud Metadata Service]
76	F[External Web Services]
77	G[Local Services on Same Server]
78	end
79
80	C --- D
81	C --- E
82	C --- F
83	C --- G
84	```
85
86	Types of SSRF include:
87
88	- Basic SSRF: Direct requests to internal/external resources
89	- Blind SSRF: No response returned, but requests still occur
90	- Semi-blind SSRF: Limited information returned in responses
91	- Time-based SSRF: Detection through response timing differences
92	- Out-of-band SSRF: Secondary channel used for data exfiltration
93
94	## Hunt
95
96	### Identifying SSRF Vectors
97
98	- URL Input Fields:
99	- Website preview generators
100	- Document/image imports from URLs
101	- API integrations with external services
102	- Webhook configurations
103	- Export to PDF/screenshot functionality
104
105	- Proxy Functionality:
106	- Web proxies
107	- Content fetchers
108	- API gateways
109	- Translation services
110
111	- File Processing:
112	- Media conversion tools
113	- Document processors
114	- XML/JSON processors with external entity support
115
116	- Integration Points:
117	- Third-party service connections
118	- Cloud storage integrations
119	- Monitoring systems
120	- Webhook endpoints
121
122	```mermaid
123	mindmap
124	root((SSRF Vectors))
125	URL Input Fields
126	Website Previews
127	URL Imports
128	API Integrations
129	Webhooks
130	PDF/Screenshot Export
131	Proxy Functionality
132	Web Proxies
133	Content Fetchers
134	API Gateways
135	Translation Services
136	File Processing
137	Media Converters
138	Document Processors
139	XML/JSON Processors
140	Integration Points
141	Third-party Services
142	Cloud Storage
143	Monitoring Systems
144	Webhook Endpoints
145	```
146
147	### Test Methodology
148
149	1. Identify Parameters: Find URL or hostname parameters
150	2. Setup Listener: Configure a system to detect callbacks
151	- Public server with unique URL
152	- Burp Collaborator
153	- Tools like Interactsh or canarytokens.org
154	3. Test Internal Access: Try a

People who liked this also viewed

6 picks

Type