How do I install the Server Side skill?

Run npx skillmds add transilienceai/server-side in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Server Side safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Server Side?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Server Side free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Server Side?

transilienceai (@transilienceai) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Server Side by transilienceai — Agent Skill

Name: Server Side
Rating: 4.2 (5 reviews)
Author: transilienceai

File contents

Server-Side

Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration.

Techniques

Type	Key Vectors
SSRF	Internal service access, cloud metadata, protocol smuggling
HTTP Smuggling	CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync
Path Traversal	Directory traversal, null bytes, encoding bypass
File Upload	Extension bypass, content-type manipulation, polyglot files
Deserialization	Java, PHP, Python, .NET gadget chains
Host Header	Password reset poisoning, cache poisoning, routing-based SSRF
CUPS / cups-browsed	CVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md`)

Workflow

Identify server-side processing points
Test for vulnerability class indicators
Bypass protections (WAF, allowlists, encoding filters)
Demonstrate impact (file read, RCE, internal access)
Capture evidence with PoC

Reference

reference/scenarios/ssrf/*.md - SSRF techniques and labs
reference/http-request-smuggling*.md - Smuggling techniques
reference/scenarios/path-traversal/*.md - Path traversal bypass methods
reference/file-upload*.md - File upload exploitation
reference/insecure-deserialization*.md - Deserialization attacks
reference/http-host-header*.md - Host header injection
skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug

---name: server-sidedescription: Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.--- # Server-Side Test for server-side vulnerabilities that allow unauthorized access, RCE, or data exfiltration. ## Techniques | Type | Key Vectors | |------|-------------| | **SSRF** | Internal service access, cloud metadata, protocol smuggling | | **HTTP Smuggling** | CL.TE, TE.CL, TE.TE, CL.0, H2.CL, h2c, multi-layer proxy chains, connection pooling desync | | **Path Traversal** | Directory traversal, null bytes, encoding bypass | | **File Upload** | Extension bypass, content-type manipulation, polyglot files | | **Deserialization** | Java, PHP, Python, .NET gadget chains | | **Host Header** | Password reset poisoning, cache poisoning, routing-based SSRF | | **CUPS / cups-browsed** | CVE-2024-47076/47175/47176/47177 — UDP browse → IPP injection → PPD injection → foomatic-rip RCE (see `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md`) | ## Workflow 1. Identify server-side processing points 2. Test for vulnerability class indicators 3. Bypass protections (WAF, allowlists, encoding filters) 4. Demonstrate impact (file read, RCE, internal access) 5. Capture evidence with PoC ## Reference - `reference/scenarios/ssrf/*.md` - SSRF techniques and labs - `reference/http-request-smuggling*.md` - Smuggling techniques - `reference/scenarios/path-traversal/*.md` - Path traversal bypass methods - `reference/file-upload*.md` - File upload exploitation - `reference/insecure-deserialization*.md` - Deserialization attacks - `reference/http-host-header*.md` - Host header injection - `skills/infrastructure/reference/scenarios/network-recon/cups-browsed-rce.md` - CUPS RCE chain (CVE-2024-47076/175/176/177); ipptool false positives vs libcups runtime parser; ippserver Python lib version-1.1 hardcode bug

Frequently asked questions