Awesome GitHub RepositoriesServer Side Request Forgery

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Pikachu هي منصة تدريب على أمن الويب وصندوق رمل لتطبيقات الويب الضعيفة. توفر بيئة مختبر داخل حاويات مصممة لممارسة اختبار الاختراق وتحديد عيوب الأمان الشائعة. يعمل المشروع كمختبر ممارسة لـ OWASP Top 10، ويقدم مجموعة محاكاة للمخاطر الحرجة. يتضمن سيناريوهات محددة لممارسة استغلال حقن SQL، والبرمجة عبر المواقع (XSS)، وتنفيذ الكود عن بُعد، وكسر التحكم في الوصول. تغطي البيئة مجموعة واسعة من محاكيات اختبار الأمان، بما في ذلك اجتياز الأدلة، وتزوير الطلبات من جانب الخادم (SSRF)، وتحميل الملفات غير الآمن، وهجمات الكيانات الخارجية XML (XXE). كما تتميز بواجهة خلفية إدارية لإدارة محاكيات التصيد الاحتيالي ومراقبة حمولات الجلسات الملتقطة. يتم نشر المنصة بأكملها عبر صورة داخل حاوية تقوم تلقائياً بتهيئة مخطط قاعدة البيانات وملء البيئة ببيانات أولية.

Automatic SSRF fuzzer and exploitation tool

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

A DNS rebinding attack framework.

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

Escalate your SSRF vulnerabilities on Modern Cloud Environments. surf allows you to filter a list of hosts, returning a list of viable SSRF candidates.

Simple DNS Rebinding Service

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Toolkit to detect and keep track on Blind XSS, XXE & SSRF

A simple SSRF-testing sheriff written in Go

Automatic tool for DNS rebinding-based SSRF attacks

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

Smart ssrf scanner using different methods like parameter brute forcing in post and get...

DNS rebinding toolkit

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.