from claude-bughunter231
Guided hunting methodology for server-side request forgery (SSRF): detection, OOB validation, payloads, bypass techniques, and escalation chains.
Provides a structured, field-tested methodology for discovering and validating SSRF vulnerabilities. Includes target prioritization (cloud metadata, Kubernetes, link-preview endpoints), out-of-band confirmation (Burp Collaborator / interactsh), payloads for cloud metadata and internal services, and bypass techniques for common filters. Also offers triage guidance to confirm impact and reproduceability.
Use this skill during web application security testing, bug-bounty hunts, and red-team engagements when you need to systematically find SSRF sinks, confirm blind SSRF via OOB callbacks, and escalate findings to cloud credential exfiltration or internal service access. Ideal for endpoints that accept URLs, file imports, link previews, and headless-renderer features.
Inferable: agents with security-testing and network fetch tools (Claude Code, Hermes-like security assistants, LLM agents that can run curl/requests).
This skill has not been reviewed by our automated audit pipeline yet.
