mcpField
P
performing-ssrf-vulnerability-exploitation

performing-ssrf-vulnerability-exploitation

github.com/mukul975Security35.2k248 installsUpdated 8w ago
Repository

About performing-ssrf-vulnerability-exploitation

A security-testing skill for authorized SSRF assessment, covering payload checks, response analysis, and report generation. It is intended for security practitioners working in test or lab environments.

Key features

  1. 01Testing URL parameters with SSRF payloads
  2. 02Checking cloud metadata and internal services
  3. 03Trying protocol handlers and bypass techniques
  4. 04Analyzing responses for access or disclosure
  5. 05Generating a vulnerability report

Use cases

  1. 01Assessing an application’s URL-fetching feature
  2. 02Validating SSRF controls in a lab
  3. 03Investigating an SSRF-related security incident

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-ssrf-vulnerability-exploitation

After installing, type/performing-ssrf-vulnerability-exploitationin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

When to Use

  • When conducting security assessments that involve performing ssrf vulnerability exploitation
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install requests
  2. Identify URL parameters in the target application that accept URLs or hostnames.
  3. Test SSRF payloads:
    • Cloud metadata: http://169.254.169.254/latest/meta-data/
    • Internal services: http://127.0.0.1:port/, http://10.0.0.1/
    • Protocol handlers: file:///etc/passwd, gopher://, dict://
    • Bypass techniques: IP encoding, DNS rebinding, URL redirects
  4. Analyze responses for information disclosure or internal access confirmation.
  5. Generate a vulnerability assessment report.
# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF
GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.

Comments

Markdown supported