Profile My skills Saved Collections Edit profile Submit a skill

Extended SSRF Detection (Cloud Metadata & Protocol Exploits)

Detects SSRF vulnerabilities targeting cloud metadata services, internal networks, and non-HTTP protocols.

zakirkun Updated
DevOps & Infra

File contents

Extended SSRF Detection (Cloud Metadata & Protocol Exploits)

Overview

Server-Side Request Forgery (SSRF) attacks using specific targets and protocols:

  1. Cloud metadata endpoints:

    • AWS: http://169.254.169.254/latest/meta-data/
    • GCP: http://metadata.google.internal/
    • Azure: http://169.254.169.254/metadata/

  2. Non-HTTP protocols:

    • file://: Read local files
    • gopher://: Binary protocol for internal service exploitation
    • dict://: Info leak via Redis/Memcached
    • ftp://: Internal FTP access

  3. IPv6 bypass: http://[::1]/ to reach localhost

  4. URL encoding bypass: http://127.0.0.1%2F/ or http://0x7f000001/

Remediation

  • Allowlist permitted URL schemes (only https://)
  • Allowlist permitted destination IPs/domains
  • Use a dedicated HTTP client proxy that enforces policies
  • Disable file://, gopher://, dict:// in HTTP clients

zakirkun/ice-tea/tree/main/skills/network/ssrf-extended commit c5572408af

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/extended-ssrf-detection-cloud-metadata-protocol-exploits