SSRF Vulnerability Testing Tools

ssrfmap is an automatic SSRF fuzzer and exploitation tool purpose-built for finding and exploiting SSRF vulnerabilities, covering detection and exploitation with automation support, which directly matches the visitor's need for SSRF analysis and exploitation.

ssrfire is an automated SSRF finder that detects the vulnerability and uses a callback server for response analysis, fitting the core need for SSRF detection and exploitation, though it is unclear if it includes request interception or a dedicated proxy.

This tool is specifically designed for performing DNS rebinding-based SSRF attacks, fitting the core category of SSRF exploitation and analysis. While it focuses on a single technique rather than covering all SSRF types, it is a genuine tool in the space.

Surf is a dedicated SSRF exploitation tool that filters hosts to identify viable SSRF candidates and escalate vulnerabilities in cloud environments, making it the right kind of tool for detection and exploitation, though it does not explicitly cover request interception or a built-in callback server.

Lorsrf is a fast CLI tool that specifically finds parameters vulnerable to SSRF and Out-of-band resource loads, which covers the detection part of your request, but it does not include exploitation payloads, a request interception proxy, or a callback server for full analysis.

This repository is a Python-based SSRF scanner that brute-forces parameters to detect and exploit vulnerabilities, fitting your need for detection and exploitation automation, though it may not include a built-in proxy or callback server.

A toolkit that detects and tracks Blind XSS, XXE, and SSRF, which fits the SSRF category but may focus more on detection than exploitation or proxy features, matching the broad requirement while likely lacking some advanced functionality.

ssrf-sheriff is a dedicated Go-based tool for testing Server-Side Request Forgery, which fits your need for an SSRF detection and analysis tool, though it may be simpler and less comprehensive than a full-featured exploitation suite.

sentryssrf is a Python tool that specifically hunts for blind SSRF by checking Sentry configurations found on pages or in JavaScript files, making it a targeted SSRF analysis tool that fits the search's core category.

OkHttp is an HTTP client library, not an SSRF exploitation tool—it provides networking primitives but lacks SSRF detection, payloads, proxy interception, or a callback server, making it a building block rather than a dedicated solution.

Netch is a multi-protocol proxy client and traffic interceptor for routing connections through tunnels, which is a building block that could assist SSRF exploitation but does not itself detect, exploit, or analyze SSRF vulnerabilities.

spy-debugger is a mobile HTTP debugging proxy, not an SSRF-specific tool—while it can intercept requests, it lacks SSRF detection, exploitation payloads, callback servers, or automation for vulnerability analysis.