ssrf 开源项目推荐（656 个）

nahamsec /Resources-for-Beginner-Bug-Bounty-Hunters

为那些有兴趣开始使用错误赏金的人提供的资源列表

reddelexc /hackerone-reports

HackerOne 公开披露报告精选

swisskyrepo /SSRFmap

Automatic SSRF fuzzer and exploitation tool

tarunkant /Gopherus

该工具生成gopher链接，用于利用SSRF并在各种服务器中获得RCE

JoyChou93 /java-sec-code

基于 Spring Boot 和 Spring Security 的 Java Web 常见漏洞与安全代码

cujanovic /SSRF-Testing

SSRF (Server Side Request Forgery) testing resources

uphiago /recon-skills

162个进攻性安全技能，用于侦察和渗透。经过现场验证的技术来自45多个行业的600多个目标。更新了源IP发现，子域接管，GitHub秘密狩猎，浏览器指纹规避，SCADA枚举和自动CMS检测。

pipelab-org /pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

cn-panda /JavaCodeAudit

Getting started with java code auditing 代码审计入门的小项目

incredibleindishell /SSRF_Vulnerable_Lab

This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack

YagamiiLight /Cerberus

一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能

luisfontes19 /xxexploiter

Tool to help exploit XXE vulnerabilities

Dliv3 /redis-rogue-server

Redis 4.x/5.x RCE

Li4n0 /revsuit

RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetration.

bcoles /ssrf_proxy

SSRF Proxy facilitates tunneling HTTP communications through servers vulnerable to Server-Side Request Forgery.

tangxiaofeng7 /SecExample

JAVA 漏洞靶场 (Vulnerability Environment For Java)

chennqqi /godnslog

An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability

ImAyrix /fallparams

Find All Parameters - Tool to crawl pages, find potential parameters and generate a custom target parameter wordlist

sqlsec /ssrf-vuls

国光的手把手带你用 SSRF 打穿内网靶场源码

Th0h0 /autossrf

Smart context-based SSRF vulnerability scanner.