# Extended SSRF Detection (Cloud Metadata & Protocol Exploits)

> Detects SSRF vulnerabilities targeting cloud metadata services, internal networks, and non-HTTP protocols.

- Skill: `zakirkun/extended-ssrf-detection-cloud-metadata-protocol-exploits` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/extended-ssrf-detection-cloud-metadata-protocol-exploits`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/extended-ssrf-detection-cloud-metadata-protocol-exploits/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/extended-ssrf-detection-cloud-metadata-protocol-exploits

---


# Extended SSRF Detection (Cloud Metadata & Protocol Exploits)

## Overview
Server-Side Request Forgery (SSRF) attacks using specific targets and protocols:

1. **Cloud metadata endpoints**:
   - AWS: `http://169.254.169.254/latest/meta-data/`
   - GCP: `http://metadata.google.internal/`
   - Azure: `http://169.254.169.254/metadata/`

2. **Non-HTTP protocols**:
   - `file://`: Read local files
   - `gopher://`: Binary protocol for internal service exploitation
   - `dict://`: Info leak via Redis/Memcached
   - `ftp://`: Internal FTP access

3. **IPv6 bypass**: `http://[::1]/` to reach localhost
4. **URL encoding bypass**: `http://127.0.0.1%2F/` or `http://0x7f000001/`

## Remediation
- Allowlist permitted URL schemes (only `https://`)
- Allowlist permitted destination IPs/domains
- Use a dedicated HTTP client proxy that enforces policies
- Disable `file://`, `gopher://`, `dict://` in HTTP clients