mcpField
S
ssrf-hunting

ssrf-hunting

github.com/securityskillsSecurity0172 installsUpdated 9w ago
Repository

About ssrf-hunting

ssrf-hunting is a security skill for systematically finding and testing server-side request forgery risks. It maps URL-fetching entry points, provides test cases for bypasses and blind SSRF, and outlines remediation notes.

Key features

  1. 01Locate server-side URL fetches
  2. 02Test loopback addresses and internal hosts
  3. 03Check filter bypasses and redirects
  4. 04Test cloud metadata and blind SSRF
  5. 05Record response and remediation guidance

Use cases

  1. 01Audit URL fetching in webhooks and importers
  2. 02Test preview services and proxy endpoints
  3. 03Assess SSRF controls and cloud metadata exposure

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill ssrf-hunting

After installing, type/ssrf-huntingin Claude Code to confirm it loaded.

Details

From the project README

SSRF Hunting

Locate every place the server fetches a URL you control, then test it methodically.

Where to Look

  • Webhooks and callback URLs (payments, integrations, alerts)
  • Importers: avatar-by-URL, import-from-URL, RSS feed readers
  • Preview generators: link unfurlers, PDF/image renderers, screenshot services
  • File parsers that resolve external entities or references (XInclude, XSLT, SVG)
  • Proxy/redirect endpoints taking a url= parameter

Test Matrix

Basic
  • http://127.0.0.1:PORT for internal services (find live ports via response differential)
  • http://localhost, http://[::1], http://2130706433 (integer IP), http://0x7f000001
  • Internal hostnames: http://inventory, http://kubernetes.default.svc
Filter Bypass
  • DNS names resolving to loopback: custom records, localtest.me,nip.io patterns
  • Redirects: public URL 302→internal target (tests whether redirects are followed)
  • DNS rebinding for single-resolution filters (rebind.network tools)
  • Scheme abuse: file:///etc/passwd, gopher://, dict:// where parsers allow
Cloud Metadata (high impact)
  • AWS IMDSv1: http://169.254.169.254/latest/meta-data/iam/security-credentials/
  • AWS IMDSv2 requires token — try hop-limit tricks via 302 redirect
  • GCP: http://metadata.google.internal/computeMetadata/v1/ with Metadata-Flavor: Google
  • Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01 with Metadata: true
Blind SSRF
  • Out-of-band DNS/HTTP callbacks (interactsh-style) to confirm fetch without visible response
  • Response-time differentials against open vs filtered ports
  • Error-message leaks: connection refused vs timeout vs HTTP error codes

Rules

  • Reading metadata that returns credentials: capture minimal proof (role name, key prefix), report immediately, do not use credentials to pivot without authorization
  • Never exfiltrate real user data through the SSRF

Remediation Notes to Include

Allowlist of destinations, block link-local/loopback at network layer, disable redirect following, use IMDSv2, serve fetches from an isolated egress-controlled worker.

Comments

Markdown supported