Ssrf Server Side Request Forgery

This is a comprehensive SSRF exploitation playbook that goes well beyond the basic 169.254.169.254 trick most models already know. It covers cloud metadata endpoint extraction across AWS, GCP, Azure, and Alibaba, IP filter bypass using octal, hex, and IPv6-mapped formats, and protocol abuse via gopher, dict, and file schemes to hit Redis, Elasticsearch, and local filesystems. The real value is in the chaining techniques, like SSRF to internal Redis to crontab RCE, and the URL parser differential tricks that exploit how Python urllib versus Java URL versus PHP parse_url handle the same malformed input differently. Load this when you're testing anything that fetches URLs, renders PDFs from HTML, or configures webhooks, and you need the full bypass arsenal instead of just the AWS metadata basics.

skills.sh installs: 4.1K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill ssrf-server-side-request-forgery --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Server-Side Request Forgery (SSRF) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSRF techniques. Covers URL filter bypass, cloud metadata endpoints, protocol exploitation, blind SSRF detection, and chaining to RCE. Base models know basic 169.254.169.254 — this file covers what they miss. For real-world CVE chains, DNS Rebinding deep dives, K8s SSRF, and SSRF → Redis → RCE full exploitation, load the companion SCENARIOS.md.