Awesome GitHub RepositoriesServer Side Request Forgery

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Pikachu este o platformă de training în securitate web și un sandbox de aplicații web vulnerabile. Oferă un mediu de laborator containerizat conceput pentru exersarea testării de penetrare și identificarea defectelor comune de securitate. Proiectul servește drept laborator de practică pentru OWASP Top 10, oferind o suită de simulare pentru riscuri critice. Include scenarii specifice pentru exersarea exploatării SQL injection, cross-site scripting, remote code execution și broken access control. Mediul acoperă o gamă largă de simulări de testare a securității, inclusiv directory traversal, server-side request forgery, încărcări nesigure de fișiere și atacuri XML external entity. Dispune, de asemenea, de un backend administrativ pentru a gestiona simulările de phishing și a monitoriza payload-urile de sesiune capturate. Întreaga platformă este deployată printr-o imagine containerizată care inițializează automat schema bazei de date și populează mediul cu date de test.

Automatic SSRF fuzzer and exploitation tool

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

A DNS rebinding attack framework.

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

Escalate your SSRF vulnerabilities on Modern Cloud Environments. surf allows you to filter a list of hosts, returning a list of viable SSRF candidates.

Simple DNS Rebinding Service

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Toolkit to detect and keep track on Blind XSS, XXE & SSRF

A simple SSRF-testing sheriff written in Go

Automatic tool for DNS rebinding-based SSRF attacks

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

Smart ssrf scanner using different methods like parameter brute forcing in post and get...

DNS rebinding toolkit

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.