菜单
[exploit] Automate SSRF exploitation from a captured request + the injectable parameter — internal probing, cloud-metadata reads, port scan modules. Reach for it once an SSRF sink is identified to reach a minimal-impact PoC.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | ssrfmap |
| description | [exploit] Automate SSRF exploitation from a captured request + the injectable parameter — internal probing, cloud-metadata reads, port scan modules. Reach for it once an SSRF sink is identified to reach a minimal-impact PoC. |
SSRFmap (Python; pinned git clone, run in place from /opt/shor/tools/SSRFmap,
e.g. python ssrfmap.py). Takes a raw request file plus the SSRF-vulnerable
parameter and runs modules (internal-host probe, cloud metadata, port scan, etc.).
Live → exploitation phase. Honor the SSRF PoC ceiling: stop at first
boundary-crossing proof, no credential retrieval.
-r <req.txt> raw HTTP request file (capture via curl/Burp/Playwright).-p <param> the injectable parameter to inject SSRF payloads into.-m <modules> comma-separated: readfiles, portscan, aws, gce, azure,
digitalocean, redis, etc. Choose the minimal module for the hypothesis.-l <port> / --lhost/--lport for OOB/listener-based confirmation.--level <n> payload aggressiveness (keep low).# Probe AWS metadata reachability via the captured request's `url` param
ssrfmap -r req.txt -p url -m aws
# Internal loopback banner check: ssrfmap -r req.txt -p url -m portscan (bounded)
Capture
req.txtfirst, e.g.:curl -sS -o /dev/null --trace-ascii req.txt ...or save the Playwright/Burp request. Confirm modules withssrfmap --help.
gopher:///redis to mutate state.