web-vuln-ssrf

What this skill does

Detects Server-Side Request Forgery (SSRF) vulnerabilities by identifying URL-accepting parameters, confirming blind SSRF via out-of-band (OOB) callbacks, escalating to internal service access, and exploiting cloud instance metadata endpoints (AWS, GCP, Azure). Includes all 11 IP bypass techniques to evade server-side blocklists and filter bypasses, plus chain escalation paths from DNS-only SSRF to cloud credential extraction and RCE.

When to use

• When a request parameter accepts a URL, hostname, IP address, or domain
• When a feature fetches remote content (webhook URLs, avatar URLs, PDF generators, link previews, import by URL)
• When an SVG upload endpoint renders the file server-side
• When a redirect parameter passes user-controlled URLs to a backend fetch
• When an API accepts a callback, webhook, src, image, next, or redirect parameter

Prerequisites

• An out-of-band callback listener (interactsh recommended: interactsh-client)
• curl installed
• A valid bug bounty or pentest authorization for the target
• For cloud metadata testing: the target must be hosted on AWS, GCP, or Azure (check response headers or DNS for cloud provider signals)