competition-ssrf-metadata-pivot

Name: competition-ssrf-metadata-pivot
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-ssrf-metadata-pivot?

zhaoxuya520/reverse-skill/competition-ssrf-metadata-pivot

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-ssrf-metadata-pivot

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata

Files · 1

View on GitHub

SKILL.md

1	# Competition SSRF Metadata Pivot
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
12	2. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
13	3. Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
14	4. Distinguish read-only reachability from credential-bearing access.
15	5. Reproduce the smallest SSRF-to-accepted-access path.
16
17	## Workflow
18
19	### 1. Map SSRF Reachability
20
21	- Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback.
22	- Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection.
23	- Keep target host, protocol, and response behavior tied to the exact SSRF source.
24
25	### 2. Trace Metadata And Credential Pivot
26
27	- Show whether metadata endpoints, internal control APIs, or workload identity services are reachable.
28	- Record token fields, role scope, service account, expiration, and where the token is accepted.
29	- Distinguish credential extraction success from accepted privilege at a downstream service.
30
31	### 3. Reduce To Decisive SSRF Chain
32
33	- Compress to: SSRF source -> internal or metadata target -> credential or sensitive response -> accepted replay or API access.
34	- State whether the decisive edge is parser bypass, allowlist bypass, redirect abuse, header confusion, or metadata trust.
35	- If the task becomes mostly cloud identity policy analysis, hand off to the tighter cloud metadata skill.
36
37	## Read This Reference
38
39	- Load `references/ssrf-metadata-pivot.md` for SSRF checklists, metadata pivots, and evidence packaging.
40
41	## What To Preserve
42
43	- SSRF source point, URL construction rules, reachable hosts, and response deltas
44	- Extracted token or credential fields, scope, and accepting service
45	- One minimal SSRF-to-accepted-access replay path

People who liked this also viewed

6 picks

Type

competition-ssrf-metadata-pivot

8.8kstars1.4kforks

View on GitHub

How to install competition-ssrf-metadata-pivot?

zhaoxuya520/reverse-skill/competition-ssrf-metadata-pivot

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-ssrf-metadata-pivot

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition SSRF Metadata Pivot
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
12	2. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
13	3. Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
14	4. Distinguish read-only reachability from credential-bearing access.
15	5. Reproduce the smallest SSRF-to-accepted-access path.
16
17	## Workflow
18
19	### 1. Map SSRF Reachability
20
21	- Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback.
22	- Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection.
23	- Keep target host, protocol, and response behavior tied to the exact SSRF source.
24
25	### 2. Trace Metadata And Credential Pivot
26
27	- Show whether metadata endpoints, internal control APIs, or workload identity services are reachable.
28	- Record token fields, role scope, service account, expiration, and where the token is accepted.
29	- Distinguish credential extraction success from accepted privilege at a downstream service.
30
31	### 3. Reduce To Decisive SSRF Chain
32
33	- Compress to: SSRF source -> internal or metadata target -> credential or sensitive response -> accepted replay or API access.
34	- State whether the decisive edge is parser bypass, allowlist bypass, redirect abuse, header confusion, or metadata trust.
35	- If the task becomes mostly cloud identity policy analysis, hand off to the tighter cloud metadata skill.
36
37	## Read This Reference
38
39	- Load `references/ssrf-metadata-pivot.md` for SSRF checklists, metadata pivots, and evidence packaging.
40
41	## What To Preserve
42
43	- SSRF source point, URL construction rules, reachable hosts, and response deltas
44	- Extracted token or credential fields, scope, and accepting service
45	- One minimal SSRF-to-accepted-access replay path

People who liked this also viewed

6 picks

Type