SSRFire: automated SSRF finder

[itsMe]

SSRFIRE

An automated SSRF finder. Just give the domain name and your server and chill! It also has options to find XSS and open redirects.

Finding XSS

Warning: This generates a lot of traffic. Do not use this against the sites which you are not authorized to test

This tests all the URLs fetched, and based on how the input is reflected in the response, it adds that particular URL to the output/domain.com/xss-suspects.txt (This may contain false positives)

For further testing, you can input this list to the XSS detection tools like XSStrike to find XSS.
Finding open redirects

Just enter the path to a payload file or use the default payload. I personally prefer openredirex, as it is specifically designed to check for open redirects by loading the URLs from the list and it looks a lot cleaner, and doesn’t flood your terminal.

To see this hidden content, you must like this content.