Server-Side Request Forgery (SSRF) (offensive-ssrf)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

Server-side request forgery (SSRF) assessment methodology covering URL parser differentials, DNS rebinding, redirect chains, cloud metadata protection (IMDSv2 enforcement), webhook fetchers, PDF/image renderers, and egress network allowlisting. Use when auditing server-side HTTP clients, webhooks, or URL preview features.

Operational Workflow