Automatic SSRF fuzzer and exploitation tool
-
Updated
Sep 4, 2025 - Python
#
server-side-request-forgery
Here are 27 public repositories matching this topic...
SSRF (Server Side Request Forgery) testing resources
-
Updated
Oct 12, 2024 - Python
This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack
-
Updated
Aug 21, 2023 - PHP
A ruby gem for defending against Server Side Request Forgery (SSRF) attacks
-
Updated
Jul 6, 2026 - Ruby
Proof-of-Concept for Server Side Request Forgery (SSRF) in request-baskets (<= v.1.2.1)
-
Updated
Aug 9, 2023 - Shell
A comprehensive browser extension designed for authorized security testing and penetration testing activities. CyberInject provides quick access to common security payloads across multiple vulnerability categories.
extension sql xss cybersecurity penetration-testing bug-bounty sql-injection offensive-security ethical-hacking xss-attacks red-team ssrf lfi server-side-request-forgery cross-site-scripting sql-injection-attacks google-extension vulnerbility cybersecurity-tools cybersecurity-projects
-
Updated
Jun 21, 2026 - HTML
An ongoing & curated collection of awesome web vulnerability - Server-side request forgery software practices and remediation, libraries and frameworks, best guidelines and technical resources about SSRF
security cybersecurity vulnerability vulnerabilities vulnerability-detection vulnerability-management server-side vulnerability-assessment ssrf mitigation remediation security-tools server-side-request-forgery
-
Updated
Feb 22, 2022 - Python
Module to prevent SSRF when sending requests in NodeJS. Blocks request to local and private IP addresses
nodejs http security block filter requests axios request node-js node-module ssrf preventive-measures server-side-request-forgery ssrf-req-filter
-
Updated
Jan 22, 2026 - JavaScript
Example exploitable scenarios for CVE-2024-22243 affecting the Spring framework (open redirect & SSRF).
url java web spring uri vulnerability ctf ssrf server-side-request-forgery open-redirect cve-2024-22243
-
Updated
Oct 22, 2024 - Java
this a ssrf scripts
http attack scanner scripts python3 fuzzing pentesting ssrf web-scanner server-side-request-forgery out-of-band bug-bounty-hunting oob-attack
-
Updated
Jun 16, 2022 - Python
Gopher HTTP requests (POST/GET)
web hacking penetration-testing bugbounty offensive-security ssrf owasp-top-10 server-side-request-forgery webhacking
-
Updated
Nov 22, 2024 - Python
Automated blind SSRF scanner with native PingBack.sh OAST correlation, persistent callbacks and exact injection tracking.
cli golang automation cybersecurity bug-bounty web-security pentesting security-scanner ssrf security-tools reconnaissance vulnerability-scanner server-side-request-forgery out-of-band oast blind-ssrf bugbounty-tools pingback-sh
-
Updated
Jul 1, 2026 - Go
Server-Side Request Forgery (SSRF) protection plugin for HTTPlug
-
Updated
Jul 6, 2026 - PHP
CloudSSRFer tests SSRF on Amazon AWS cloud to extract sensitive information.
-
Updated
Mar 20, 2026 - Python
SSRF, Server-Side Request Forgery: Exploiting a vulnerable avatar fetching feature using directory traversal to force the server to access an internal /private endpoint and retrieve a base64-encoded flag.
-
Updated
Mar 4, 2026
Lightweight SSRF (Server-Side Request Forgery) protection for HttpClient in .NET microservices.
lightweight security protection microservices csharp owasp httpclient web-security network-security ssrf owasp-top-10 api-security server-side-request-forgery vulnerability-prevention
-
Updated
Feb 17, 2026 - C#
Header-based SSRF (scanner-for-debugging) fuzzing utility inspired by a HackerOne Blind SSRF report. Automates injection of Forwarded-type headers, detects time-delay behavior and 429 responses, supports authenticated flows, logs results, and optionally integrates Telegram notifications for controlled security testing.
python bug-bounty ssrf hackerone server-side-request-forgery hacktivity blind-ssrf ssrf-tool ssrf-scanner ssrf-prevention
-
Updated
Feb 21, 2026 - Python
This is a difficult web exploitation task. To solve it, I must exploit a Server-Side Request Forgery (SSRF) vulnerability in Git webhooks and use template injection. This allowed me to gain admin privileges via localhost, create a custom Git packfile to add myself as a collaborator to the hidden repository, and then clone it to read the flag.
cyber-security git-webhook web-exploitation server-side-request-forgery injection-attack localhost-forge code-management-software
-
Updated
Oct 19, 2025
Drop-in SSRF protection for httpx
-
Updated
Aug 16, 2025 - Python
Improve this page
Add a description, image, and links to the server-side-request-forgery topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the server-side-request-forgery topic, visit your repo's landing page and select "manage topics."