mcpField
C
competition-ssrf-metadata-pivot

competition-ssrf-metadata-pivot

github.com/zhaoxuya520Security43.7k93 installsUpdated 5w ago
Repository

About competition-ssrf-metadata-pivot

A downstream CTF security skill for tracing SSRF paths to internal services or metadata-derived credentials. It helps analysts map reachability, validate where credentials are accepted, and preserve a minimal reproducible access chain.

Key features

  1. 01Map SSRF sources and reachable targets
  2. 02Trace metadata and credential pivots
  3. 03Distinguish reachability from accepted access
  4. 04Build a minimal reproducible SSRF chain
  5. 05Preserve evidence and credential scope

Use cases

  1. 01Analyze an SSRF challenge involving internal services
  2. 02Test whether metadata credentials work at a downstream service
  3. 03Document a reproducible SSRF-to-access path

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/zhaoxuya520/reverse-skill --skill competition-ssrf-metadata-pivot

After installing, type/competition-ssrf-metadata-pivotin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/ssrf-metadata-pivot.md

Details

From the project README

Competition SSRF Metadata Pivot

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

  1. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
  2. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
  3. Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
  4. Distinguish read-only reachability from credential-bearing access.
  5. Reproduce the smallest SSRF-to-accepted-access path.

Workflow

1. Map SSRF Reachability
  • Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback.
  • Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection.
  • Keep target host, protocol, and response behavior tied to the exact SSRF source.
2. Trace Metadata And Credential Pivot
  • Show whether metadata endpoints, internal control APIs, or workload identity services are reachable.
  • Record token fields, role scope, service account, expiration, and where the token is accepted.
  • Distinguish credential extraction success from accepted privilege at a downstream service.
3. Reduce To Decisive SSRF Chain
  • Compress to: SSRF source -> internal or metadata target -> credential or sensitive response -> accepted replay or API access.
  • State whether the decisive edge is parser bypass, allowlist bypass, redirect abuse, header confusion, or metadata trust.
  • If the task becomes mostly cloud identity policy analysis, hand off to the tighter cloud metadata skill.

Read This Reference

  • Load references/ssrf-metadata-pivot.md for SSRF checklists, metadata pivots, and evidence packaging.

What To Preserve

  • SSRF source point, URL construction rules, reachable hosts, and response deltas
  • Extracted token or credential fields, scope, and accepting service
  • One minimal SSRF-to-accepted-access replay path

Comments

Markdown supported