SSRFmap: SSRF Fuzzer and Exploitation Tool

What is SSRFmap?

SSRFmap is an open-source Python framework built to automate Server-Side Request Forgery exploitation once a vulnerable parameter has been found. It takes a saved HTTP request file, typically exported from Burp Suite, plus the parameter to fuzz, and runs that parameter through a library of modules targeting backend services such as Redis, MySQL, Zabbix, and cloud metadata endpoints on AWS, GCP, Alibaba, and DigitalOcean.

Exploitation Modules and Capabilities

• ✓21 service-specific modules in one framework, including axfr (DNS zone transfer), fastcgi, redis, and mysql/postgres RCE or command execution, a github module for GitHub Enterprise RCE below version 2.8.7, zabbix, tomcat bruteforce, memcache, smbhash (SMB auth via a UNC path), and docker infoleak via its API.
• ✓Cloud metadata readers for four providers — alibaba, aws, gce, and digitalocean — that pull files such as instance metadata and user-data.
• ✓portscan sweeps the top 8000 ports on the target host, and networkscan runs an HTTP ping sweep across the reachable network once SSRF gives you a foothold.
• ✓readfiles reads arbitrary files off the vulnerable host, such as /etc/passwd, and saves what it retrieves under loot/<target>/.
• ✓Reverse-shell handling built in: -l starts a local listener, and --lhost/--lport generate the connect-back payload the way Metasploit does, demonstrated in the README against a Redis target.
• ✓A *FUZZ* marker lets you inject a payload into part of a parameter's value instead of replacing it whole, and it reaches into headers, GET params, JSON or XML payloads, multipart form fields, and POST/PUT bodies alike.
• ✓--level (1-5, default 1) varies payload encoding — the README's own example rewrites 127.0.0.1 as [::] or 0000: — specifically to get past WAF or IDS filtering.

Installation Guide

Clone the repo and install with uv: `git clone https://github.com/swisskyrepo/SSRFmap`, `cd SSRFmap/`, `uv sync --frozen`, then confirm it works with `uv run python ssrfmap.py --help`. A Docker path is documented too: `docker build -t ssrfmap .`, then `docker run --rm ssrfmap ssrfmap.py --help`, mounting only the request files you need at runtime, e.g. `-v "$(pwd)/examples:/requests:ro"`. No PyPI package is documented — cloning the GitHub repo is the only installation path the README describes.

Basic and Advanced Usage

SSRFmap needs two inputs: a saved HTTP request file (a Burp Suite export works well) via -r, and the parameter to fuzz via -p. Point -m at one or more comma-separated modules, e.g. `ssrfmap.py -r examples/request.txt -p url -m readfiles,portscan`. To target a header instead of a body parameter, pass its name straight to -p, e.g. -p X-Custom-Header. When a parameter's value should stay mostly intact, drop a *FUZZ* marker at the exact injection point instead of letting SSRFmap replace the whole value — that same marker reaches headers, GET params, JSON/XML bodies, POST or PUT payloads, and multipart form fields alike. For reverse shells, say against a Redis module, set --lhost/--lport and add -l to start a local listener. --ssl connects to HTTPS targets without verifying the certificate, --uagent sets a custom User-Agent, --proxy routes traffic through something like a local Burp listener, and --level (1-5, default 1) widens the range of payload encodings tried against WAF or IDS filtering. The README also documents `uv run pytest` and `uv run ruff check .` for running SSRFmap's own test suite and lint checks.

Tools That Inspired SSRFmap

Frequently Asked Questions

The problem it solves

Exploiting a confirmed SSRF past a simple proof of concept usually means hand-building payloads for whatever is actually listening behind the vulnerable server — a Redis instance, a cloud metadata endpoint, an internal service — and redoing that work on every engagement. SSRFmap's README frames the tool around exactly that gap: turning a captured request and a parameter name into automated exploitation across a library of backend-specific modules instead of one-off gopher payloads written by hand.

Best use cases

• •Turning a confirmed SSRF finding on an authorized pentest into concrete impact — reading /etc/passwd, dumping AWS, GCP, Alibaba, or DigitalOcean instance metadata, or opening a reverse shell on a Redis backend — without writing the exploit payload by hand.
• •CTF challenges that hide an internal service behind an SSRF-prone parameter; the repo carries ctf and hacktoberfest among its own topics.
• •Checking whether a WAF or IDS in front of a target actually blocks SSRF payloads, using --level to cycle through encodings like 127.0.0.1 to [::] to 0000:.
• •Mapping what a vulnerable server can reach internally with the portscan and networkscan modules once SSRF exists but there's no direct network access to the target.

Who should try it — and who should skip

Try SSRFmap if you do authorized pentest or CTF work, you've already spotted or strongly suspect an SSRF-prone parameter, and you want to push past confirmation into actual file reads, cloud metadata, or a shell without writing gopher payloads by hand. Skip it if you're still at the discovery stage and need a general web vulnerability scanner, or if your target doesn't map to one of the documented backend modules — SSRFmap won't invent an exploit path for a service it has no module for.

Related repositories