Competition SSRF Metadata Pivot

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

1. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
2. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
3. Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
4. Distinguish read-only reachability from credential-bearing access.
5. Reproduce the smallest SSRF-to-accepted-access path.

Workflow

1. Map SSRF Reachability