chain-ssrf-to-rce

name: chain-ssrf-to-rce description: Build and validate SSRF pivot chains toward metadata/infra control and final code execution impact. metadata: subdomain: web-exploitation when_to_use: "ssrf chain rce remote code execution pivot cloud metadata imds iam role gopher dns rebinding"

Chain: SSRF to RCE

Canonical path

1. SSRF reaches metadata/internal control plane.
2. Extract credential/token or access internal admin API.
3. Use credential to deploy or execute payload.
4. Confirm code execution and business impact.

Graph guidance

• Add enables edges for each pivot.
• Lower weights for direct pivots; higher for speculative pivots.
• Run plan_attack_chains and then suggest_objectives_from_chains.