SSRFmap is an automatic SSRF fuzzer and exploitation tool that identifies and exploits server-side request forgery vulnerabilities.
The tool addresses the challenge of discovering and leveraging SSRF vulnerabilities to perform unauthorized actions on backend services. It works by accepting a Burp request file and a target parameter to fuzz, then systematically testing that parameter against a library of exploitation modules designed to interact with common services and protocols.
SSRFmap suits penetration testers and security researchers conducting vulnerability assessments or capture-the-flag competitions. It is most valuable when you have identified a potential SSRF vector and need to quickly determine what backend services are accessible and exploitable. The tool provides modules for attacking a wide range of targets including databases like Redis, MySQL, and Postgres; cloud metadata endpoints from AWS, Google Cloud, and DigitalOcean; services like Docker, Zabbix, and Tomcat; and network reconnaissance capabilities such as port scanning and SMB hash extraction. The fuzzing parameter supports flexible payload placement through the *FUZZ* marker, allowing injection into GET parameters, POST bodies, headers, JSON, XML, and multipart fields. Additional features include WAF bypass through configurable encoding levels, reverse shell listening capabilities, and custom payload injection.
The project maintains active continuous integration testing and accepts community contributions. Development activity shows ongoing refinement of exploitation modules and payload handling capabilities to address evolving target services and evasion techniques.
