A tool search for SSRF using predefined settings in different parts of a request
Extended ssrf search
This tool search for SSRF using predefined settings in different parts of a request (path, host, headers, post and get parameters).
First step
Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend to use burp collaborator. Then you can add your urls to config/url-to-test.txt. Here the script accepts domains as well as urls with path and query parameters. If you like you can add your own cookies to config/cookie-jar.txt and add additional headers for your requests. The brute force list which is used in post and get requests is currently small, I dont thing adding 2000 parameters is smart. We should focus on those which have the highest possibility to be vulnerable. If you don’t think so: