Awesome GitHub RepositoriesServer Side Request Forgery

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Pikachu ist eine Plattform für Web-Sicherheitstraining und eine Sandbox für verwundbare Webanwendungen. Sie bietet eine containerisierte Laborumgebung, die für das Üben von Penetrationstests und das Identifizieren häufiger Sicherheitslücken konzipiert ist. Das Projekt dient als OWASP Top 10-Übungslabor und bietet eine Simulationssuite für kritische Risiken. Es enthält spezifische Szenarien zum Üben der Ausnutzung von SQL-Injection, Cross-Site-Scripting, Remote Code Execution und fehlerhafter Zugriffskontrolle. Die Umgebung deckt ein breites Spektrum an Sicherheitstest-Simulationen ab, einschließlich Directory Traversal, Server-Side Request Forgery, unsicherer Datei-Uploads und XML External Entity-Angriffen. Sie verfügt zudem über ein administratives Backend zur Verwaltung von Phishing-Simulationen und zur Überwachung erfasster Session-Payloads. Die gesamte Plattform wird über ein containerisiertes Image bereitgestellt, das automatisch das Datenbankschema initialisiert und die Umgebung mit Seed-Daten füllt.

Automatic SSRF fuzzer and exploitation tool

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

A DNS rebinding attack framework.

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

Escalate your SSRF vulnerabilities on Modern Cloud Environments. surf allows you to filter a list of hosts, returning a list of viable SSRF candidates.

Simple DNS Rebinding Service

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Toolkit to detect and keep track on Blind XSS, XXE & SSRF

A simple SSRF-testing sheriff written in Go

Automatic tool for DNS rebinding-based SSRF attacks

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

Smart ssrf scanner using different methods like parameter brute forcing in post and get...

DNS rebinding toolkit

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.