hunt-ssrf
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONOBFUSCATIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides various shell commands for network interaction and security testing tools, including
curlfor HTTP requests,ffuffor parameter discovery, andgrepfor static code analysis. - [OBFUSCATION]: Includes Base64-encoded URL payloads within examples that demonstrate how to bypass application-layer filters by hiding internal IP addresses from simple pattern matching.
- [DYNAMIC_EXECUTION]: Contains a Python script for establishing a local redirect server and JavaScript snippets intended for execution within headless browser contexts to exfiltrate internal data.
- [DATA_EXFILTRATION]: Outlines detailed procedures for exfiltrating sensitive data via SSRF, including methods to retrieve AWS/GCP/Azure metadata tokens and Kubernetes service account credentials.
Audit Metadata