---
name: "ssrf-defense-private-ip-blocker"
description: "Protect internal microservices and cloud metadata endpoints against SSRF attacks."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "prevent ssrf attack"
  - "block private ip range fetch"
  - "protect aws metadata endpoint 169.254.169.254"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# SSRF Defense & Private IP Address Blocker

Blocks Server-Side Request Forgery (SSRF): resolving domain DNS, validating IP addresses against private CIDR blocks (RFC 1918, 169.254.169.254, loopback), and forbidding internal HTTP redirection.

## When to Invoke
Invoke this skill whenever you need to:
- prevent ssrf attack
- block private ip range fetch
- protect aws metadata endpoint 169.254.169.254

## Execution SOP & Rules
1. Resolve hostnames to IP addresses prior to connecting, validating against private CIDR blocks.
2. Block private ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.
3. Disable automated HTTP redirect following in client libraries to prevent redirecting to internal IPs.
4. Execute outbound webhooks from isolated network egress proxies with restricted VPC routing.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.