Awesome GitHub RepositoriesServer Side Request Forgery

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

Pikachu 是一个 Web 安全培训平台和易受攻击的 Web 应用沙盒。它提供了一个容器化的实验环境，旨在练习渗透测试和识别常见的安全漏洞。 该项目作为 OWASP Top 10 练习实验室，提供了一套针对关键风险的模拟套件。它包括用于练习 SQL 注入、跨站脚本 (XSS)、远程代码执行和失效的访问控制等漏洞利用的具体场景。 该环境涵盖了广泛的安全测试模拟，包括目录遍历、服务端请求伪造 (SSRF)、不安全的文件上传和 XML 外部实体 (XXE) 攻击。它还具有一个管理后台，用于管理钓鱼模拟并监控捕获的会话负载。 整个平台通过容器化镜像部署，该镜像会自动初始化数据库模式并使用种子数据填充环境。

Automatic SSRF fuzzer and exploitation tool

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

A DNS rebinding attack framework.

An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects

Escalate your SSRF vulnerabilities on Modern Cloud Environments. surf allows you to filter a list of hosts, returning a list of viable SSRF candidates.

Simple DNS Rebinding Service

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

A front-end JavaScript toolkit for creating DNS rebinding attacks.

DNS Rebinding Exploitation Framework

Toolkit to detect and keep track on Blind XSS, XXE & SSRF

A simple SSRF-testing sheriff written in Go

Automatic tool for DNS rebinding-based SSRF attacks

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

Smart ssrf scanner using different methods like parameter brute forcing in post and get...

DNS rebinding toolkit

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.