hellodqy/mastermind-bug-bounty/ssrf-test
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Test server-side URL retrieval, callback, proxy, import, and preview features for network-boundary crossing and credential or metadata access.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/ssrf-testSKILL.md
SSRF Test
Goal
判断服务端请求能力是否允许跨越预期的协议、主机、解析或云网络边界，并证明可访问的敏感能力。
Tools / Inputs
- URL/host/callback 参数、重定向链、DNS/OOB 证据、云与内网指纹
- 资源索引：
references/INDEX.md；候选资源：ssrf-testing.md、cloud-attack-surface.md
Constraints
- 先使用自控回连或无害目标确认服务端请求。
- 不进行内网大范围扫描。
- DNS 命中本身只证明请求线索，需继续证明可读取或调用的敏感结果。
- 分开验证解析、重定向、协议和响应回显边界。
- 获取的凭据只做最小权限与影响验证。
Chain Questions
- 请求由哪个网络位置、身份和协议栈发出？
- 校验发生在解析、重定向之前还是之后？
- 是否能读取响应、命中云元数据或调用内部管理接口？
- 得到的新 URL、token 或服务名应回注哪个攻击面？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/ssrf_test/SKILL.md
Popularity
- Repository stars
- 14
- Repository forks
- 1
- 7-day trend score
- 19
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/ssrf-test)