competition-ssrf-metadata-pivot

1# Competition SSRF Metadata Pivot
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
122. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
133. Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
144. Distinguish read-only reachability from credential-bearing access.
155. Reproduce the smallest SSRF-to-accepted-access path.
16 
17## Workflow
18 
19### 1. Map SSRF Reachability
20 
21- Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback.
22- Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection.
23- Keep target host, protocol, and response behavior tied to the exact SSRF source.
24 
25### 2. Trace Metadata And Credential Pivot
26…