reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-ssrf-metadata-pivot/references/ssrf-metadata-pivot.md

@@ -0,0 +1,27 @@
+# SSRF Metadata Pivot Checklist
+
+## First Pass
+
+- SSRF source parameter, URL builder, method, headers, redirect handling
+- Host allowlist or denylist logic, DNS behavior, scheme checks, proxy layers
+- Reachable internal services, metadata endpoints, token responses
+
+## Chain To Reconstruct
+
+1. Server-side fetch primitive is confirmed
+2. Internal or metadata endpoint is reachable
+3. Credential or sensitive response is extracted
+4. Downstream service accepts the recovered material
+5. Resulting capability is reproduced
+
+## Evidence To Keep Together
+
+- Source side: endpoint, parameter, URL construction, normalization rules
+- Pivot side: target host, metadata path, token fields, scope, expiry
+- Acceptance side: target API or service, replay method, resulting privilege
+
+## Common Pitfalls
+
+- Treating metadata reachability as equivalent to privilege without acceptance proof
+- Ignoring redirects, host normalization, or proxy-injected headers
+- Skipping the final accepted-access step and reporting only response leakage