performing-blind-ssrf-exploitation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs direct use of Authorization headers in curl examples and explicit retrieval/exfiltration of cloud metadata (IAM credentials) via SSRF—actions that require reading and embedding secret values verbatim into requests or reports, creating high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs are not typical download links (no direct .exe/.msi/.dmg etc.) but are highly suspicious: they are clearly SSRF/OOB-callback and metadata/internal-host probing payloads (including redirects, IP-encoding obfuscation and rebinding domains) that can be used to access sensitive internal services or stage further malicious actions, so they pose a significant security risk even if they aren't direct malware download URLs.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This content is an explicit offensive SSRF exploitation toolkit — providing actionable payloads and code to enumerate internal networks, access cloud metadata to steal credentials, exfiltrate data via OOB/DNS, and escalate to remote code execution (e.g., gopher-for-Redis, Shellshock), and thus represents a high-risk malicious resource.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill actively instructs and implements sending payloads to and monitoring public out‑of‑band services (e.g., Burp Collaborator / COLLABORATOR.oastify.com, interact.sh, webhook.site in SKILL.md) and its runtime code reads and interprets responses/callbacks (scripts/agent.py: CallbackHandler, test_ssrf_parameter, analyze_response), so untrusted third‑party content is ingested and used to drive vulnerability decisions.