# Chain Ssrf To Rce

> Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact.

- Skill: `purpleailab/chain-ssrf-to-rce` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/chain-ssrf-to-rce`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/chain-ssrf-to-rce/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/chain-ssrf-to-rce

---


# Chain: SSRF to RCE

## Canonical path
1. SSRF reaches metadata/internal control plane.
2. Extract credential/token or access internal admin API.
3. Use credential to deploy or execute payload.
4. Confirm code execution and business impact.

## Graph guidance
- Add `enables` edges for each pivot.
- Lower weights for direct pivots; higher for speculative pivots.
- Run `plan_attack_chains` and then `suggest_objectives_from_chains`.