Awesome GitHub RepositoriesServer Side Request Forgery

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Pikachu es una plataforma de entrenamiento en seguridad web y sandbox de aplicaciones web vulnerables. Proporciona un entorno de laboratorio en contenedores diseñado para practicar pruebas de penetración e identificar fallas de seguridad comunes. El proyecto sirve como laboratorio de práctica para el OWASP Top 10, ofreciendo una suite de simulación para riesgos críticos. Incluye escenarios específicos para practicar la explotación de inyección SQL, cross-site scripting (XSS), ejecución remota de código y control de acceso roto. El entorno cubre una amplia gama de simulaciones de pruebas de seguridad, incluyendo directory traversal, server-side request forgery (SSRF), carga de archivos insegura y ataques de entidades externas XML (XXE). También cuenta con un backend administrativo para gestionar simulaciones de phishing y monitorear payloads de sesión capturados. La plataforma completa se despliega mediante una imagen en contenedores que inicializa automáticamente el esquema de la base de datos y puebla el entorno con datos de prueba.

Automatic SSRF fuzzer and exploitation tool

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

A DNS rebinding attack framework.

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

Escalate your SSRF vulnerabilities on Modern Cloud Environments. surf allows you to filter a list of hosts, returning a list of viable SSRF candidates.

Simple DNS Rebinding Service

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Toolkit to detect and keep track on Blind XSS, XXE & SSRF

A simple SSRF-testing sheriff written in Go

Automatic tool for DNS rebinding-based SSRF attacks

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

Smart ssrf scanner using different methods like parameter brute forcing in post and get...

DNS rebinding toolkit

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.