How does this skill assist in cloud security audits?

It provides specific workflows and payloads to target cloud metadata endpoints (IMDS) for AWS, Azure, and GCP, which can be used to exfiltrate sensitive IAM credentials.

Can this skill help bypass security filters?

Yes, it includes techniques such as DNS rebinding, various IP address representations (hex, octal, decimal), and URL parsing confusion to circumvent allowlists and blacklists.

What is a Blind SSRF vulnerability?

Blind SSRF occurs when a server makes a request to a URL provided by a user but does not return the response body, requiring out-of-band techniques or timing analysis to confirm the vulnerability.

What tools are recommended for out-of-band detection?

This skill recommends using Burp Collaborator, interact.sh, or webhook.site to monitor for DNS lookups and HTTP requests initiated by the target server.

Blind SSRF Exploitation & Detection

Name: Blind SSRF Exploitation & Detection
Author: micsapp

bymicsapp

0•

Security & Testing

Detects and exploits blind Server-Side Request Forgery vulnerabilities using out-of-band techniques and cloud metadata analysis.

This skill provides a comprehensive methodology for identifying and leveraging blind SSRF vulnerabilities where server responses are not directly visible. It guides security professionals through out-of-band (OOB) detection using DNS and HTTP callbacks, internal network enumeration via timing analysis, and advanced exploitation of cloud metadata endpoints (AWS, GCP, Azure). It is an essential resource for penetration testing webhooks, PDF generators, and image processors to uncover hidden access to internal services and infrastructure credentials.

Key Features

01Internal network and port scanning via timing-based analysis

02Out-of-band (OOB) detection using Burp Collaborator and interact.sh

03Cloud metadata endpoint exploitation for AWS, GCP, and Azure

04Comprehensive bypass strategies for IP filters and URL parsing logic

050 GitHub stars

06Advanced protocol manipulation using Gopher for internal service interaction

Use Cases

01Assessing cloud environments for unauthorized access to instance metadata and IAM roles

02Scanning and enumerating internal network services from a compromised application point

03Testing webhook and URL input parameters for hidden server-side interactions

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills performing-blind-ssrf-exploitation

For use in Claude.ai and ChatGPT

Key Features

01Internal network and port scanning via timing-based analysis

02Out-of-band (OOB) detection using Burp Collaborator and interact.sh

03Cloud metadata endpoint exploitation for AWS, GCP, and Azure

04Comprehensive bypass strategies for IP filters and URL parsing logic

050 GitHub stars

06Advanced protocol manipulation using Gopher for internal service interaction

Use Cases

01Assessing cloud environments for unauthorized access to instance metadata and IAM roles

02Scanning and enumerating internal network services from a compromised application point

03Testing webhook and URL input parameters for hidden server-side interactions

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills performing-blind-ssrf-exploitation

For use in Claude.ai and ChatGPT