Strix•SSRF 测试
Strix SSRF 测试手册,覆盖云元数据访问、内网服务发现与协议走私;触发名:strix-ssrf
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-ssrf --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# SSRF Server-Side Request Forgery enables the server to reach networks and services the attacker cannot. Focus on cloud metadata endpoints, service meshes, Kubernetes, and protocol abuse to turn a single fetch into credentials, lateral movement, and sometimes RCE. ## Attack Surface **Scope** - Outbound HTTP/HTTPS fetchers (proxies, previewers, importers, webhook testers) - Non-HTTP protocols via URL handlers (gopher, dict, file, ftp, smb wrappers) - Service-to-service hops through gateways and sidecars (envoy/nginx) - Cloud and platform metadata endpoints, instance services, and control planes **Direct URL Params** - `url=`, `link=`, `fetch=`, `src=`, `webhook=`, `avatar=`, `image=` **Indirect Sources** - Open Graph/link previews, PDF/image renderers - Server-side analytics (Referer trackers), import/export jobs - Webhooks/callback verifiers **Protocol-Translating Services** - PDF via wkhtmltopdf/Chrome headless, image pipelines - Document parsers, SSO validators, archive expanders **Less Obvious** - GraphQL resolvers that fetch by URL - Background crawlers, repository/package managers (git, npm, pip) - Calendar (ICS) fetchers ## High-Value Targets ### AWS - IMDSv1: `http://169.25
- Attack Surface
- High-Value Targets
- AWS
- GCP
- Azure
- Kubernetes
- Internal Services
- Key Vulnerabilities
- Protocol Exploitation
- Address Variants
- URL Confusion
- Redirect Abuse
- Header and Method Control
- Bypass Techniques
What does the Strix•SSRF 测试 skill do?
Strix SSRF 测试手册,覆盖云元数据访问、内网服务发现与协议走私;触发名:strix-ssrf
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-ssrf --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.