Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

performing-ssrf-vulnerability-exploitation

Étoiles6

Forks2

Mis à jour1 juillet 2026 à 01:50

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

idpass

idpass/idpass-data-collect

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

Explorateur de fichiers

3 fichiers

SKILL.md

readonly

name	performing-ssrf-vulnerability-exploitation
description	Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
domain	cybersecurity
subdomain	security-operations
tags	["ssrf","web-application-security","cloud-metadata-abuse","vulnerability-exploitation","penetration-testing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]
mitre_attack	["T1078","T1190","T1059","T1078.004","T1530"]

When to Use

When conducting security assessments that involve performing ssrf vulnerability exploitation
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Identify URL parameters in the target application that accept URLs or hostnames.
Test SSRF payloads:
- Cloud metadata: http://169.254.169.254/latest/meta-data/
- Internal services: http://127.0.0.1:port/, http://10.0.0.1/
- Protocol handlers: file:///etc/passwd, gopher://, dict://
- Bypass techniques: IP encoding, DNS rebinding, URL redirects
Analyze responses for information disclosure or internal access confirmation.
Generate a vulnerability assessment report.

# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.

Plus depuis ce dépôt

même dépôt

bypassing-authentication-with-forced-browsing

idpass/idpass-data-collect

Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.

2026-07-016

detecting-api-enumeration-attacks

idpass/idpass-data-collect

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

2026-07-016

detecting-supply-chain-attacks-in-ci-cd

idpass/idpass-data-collect

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

2026-07-016

exploiting-broken-function-level-authorization

idpass/idpass-data-collect

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.

2026-07-016

exploiting-excessive-data-exposure-in-api

idpass/idpass-data-collect

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.

2026-07-016

exploiting-jwt-algorithm-confusion-attack

idpass/idpass-data-collect

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.

2026-07-016

name	performing-ssrf-vulnerability-exploitation
description	Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
domain	cybersecurity
subdomain	security-operations
tags	["ssrf","web-application-security","cloud-metadata-abuse","vulnerability-exploitation","penetration-testing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]
mitre_attack	["T1078","T1190","T1059","T1078.004","T1530"]

When to Use

When conducting security assessments that involve performing ssrf vulnerability exploitation
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Identify URL parameters in the target application that accept URLs or hostnames.
Test SSRF payloads:
- Cloud metadata: http://169.254.169.254/latest/meta-data/
- Internal services: http://127.0.0.1:port/, http://10.0.0.1/
- Protocol handlers: file:///etc/passwd, gopher://, dict://
- Bypass techniques: IP encoding, DNS rebinding, URL redirects
Analyze responses for information disclosure or internal access confirmation.
Generate a vulnerability assessment report.

# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.