Can ssrfuzz find SSRF against AWS or GCP metadata endpoints?

Yes. Network fuzzing aims payloads at internal and link-local addresses, including the 169.254.169.254 metadata endpoint that returns cloud credentials on AWS and GCP. A parameter that fetches that address and echoes the response back is a confirmed SSRF.

Does ssrfuzz do CRLF fuzzing, and how does it compare to crlfuzz?

ssrfuzz runs CRLF fuzzing alongside SSRF: --crlf-path adds CRLF payloads to every path, and --skip-crlf turns it off. crlfuzz is a dedicated CRLF scanner that goes deeper on that one class. Both run as nodes on Trickest, so use ssrfuzz for combined SSRF and CRLF coverage and crlfuzz when CRLF is the whole job.

Which fuzzing categories does it run, and can I narrow them?

Three: scheme fuzzing, network fuzzing, and CRLF injection. Drop any of them with --skip-scheme, --skip-network, or --skip-crlf to keep a run focused and fast.

Does ssrfuzz support POST and authenticated targets?

Set --http-method POST to fuzz POST parameters, and pass --cookie to carry a session so it can reach endpoints behind login. --user-agent overrides the default browser string when a target filters on it.

Is SSRF the same as CSRF?

No. SSRF makes the server issue requests to addresses an attacker controls; CSRF tricks a victim's browser into sending an authenticated request. ssrfuzz tests SSRF only. See the glossary for a full SSRF vs CSRF breakdown.

Can it alert while it runs?

Yes. Give it --slack-webhook and it posts findings to the channel during the scan, so you see confirmed hits as they land instead of waiting for the run to finish.

Updated Jul 15, 2026

Vulnerabilities

Fuzz URL parameters for SSRF and CRLF vulnerabilities

A tool to find Server-Side Request Forgery vulnerabilities.

Find SSRF in URL parameters Reach cloud metadata and internal services Catch CRLF injection in the same run

overview

What ssrfuzz does

ssrfuzz hunts for server-side request forgery. Give it a list of URLs that carry parameters and it swaps each value for an SSRF payload, then watches for the responses that show the server reached out to an address it was told to fetch. Scheme fuzzing, network fuzzing, and CRLF injection all run in a single pass.

The payloads aim at the addresses SSRF exposes: loopback, internal hosts, and cloud metadata endpoints like the 169.254.169.254 IMDS that hands back credentials on AWS and GCP. Scheme fuzzing swaps http for gopher, file, and dict to reach services a plain URL cannot, and CRLF fuzzing folds header injection into the same run.

Tune it to the target. Skip any category that does not apply, switch between GET and POST bodies, and set threads and delay to push hard or stay quiet. Feed it parameterized URLs from a crawler or a parameter-discovery stage so it fuzzes inputs worth testing, and point a Slack webhook at the run to get confirmed hits in a channel as they land.

source github.com/ryandamour/ssrfuzz

use cases

Where ssrfuzz fits

Find SSRF in URL parameters

Fuzz parameterized URLs with SSRF payloads to surface endpoints where the server fetches an attacker-controlled address.

Reach cloud metadata and internal services

Point network and scheme fuzzing at loopback, internal ranges, and metadata endpoints like 169.254.169.254 to test whether a parameter can pull AWS or GCP credentials.

Catch CRLF injection in the same run

Add CRLF payloads to available paths with --crlf-path so header injection surfaces alongside SSRF instead of in a separate scan.

Scope and throttle the scan

Skip scheme or network fuzzing, choose GET or POST, and set threads and delay so the run matches the app's request shapes and its rate limits.

Stream findings to Slack

Give ssrfuzz a Slack webhook so confirmed hits post to a channel while the scan runs, not only when it finishes.

reference

ssrfuzz inputs and flags

13 inputs

Name	Type	Flag	Description
target-domains	FILE	--domains	File of URLs with parameters to fuzz.
http-method	STRING	--http-method	HTTP method, GET or POST (default "GET").
threads	STRING	--threads	Number of threads to run ssrfuzz on (default 50).
delay	STRING	--delay	Time each thread waits between requests, in milliseconds (default 100).
skip-crlf	BOOLEAN	--skip-crlf	Skip CRLF fuzzing.
skip-scheme	BOOLEAN	--skip-scheme	Skip scheme fuzzing.
skip-network	BOOLEAN	--skip-network	Skip network fuzzing.
slack-webhook	STRING	--slack-webhook	Slack webhook to post findings to a channel.

Showing key inputs. ssrfuzz exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
delay	STRING	--delay	Time each thread waits between requests, in milliseconds (default 100).
cookie	STRING	--cookie	Cookie to send with each request.
threads	STRING	--threads	Number of threads to run ssrfuzz on (default 50).
timeout	STRING	--timeout	Seconds to wait before closing a connection that has hung (default 10).
verbose	STRING	--verbose	Enable verbose output.
crlf-path	STRING	--crlf-path	Add CRLF payloads to every available path (e.g. example.com/%0Atest.php).
skip-crlf	BOOLEAN	--skip-crlf	Skip CRLF fuzzing.
http-method	STRING	--http-method	HTTP method, GET or POST (default "GET").
skip-scheme	BOOLEAN	--skip-scheme	Skip scheme fuzzing.
skip-network	BOOLEAN	--skip-network	Skip network fuzzing.
slack-webhook	STRING	--slack-webhook	Slack webhook to post findings to a channel.
target-domains	FILE	--domains	File of URLs with parameters to fuzz.
custom-user-agent	STRING	--user-agent	User agent for requests (defaults to a Chrome on Linux string).

example

Run ssrfuzz

ssrfuzz · command

# fuzz a list of parameterized URLs for SSRF and CRLF, POST bodies, throttledssrfuzz --domains params.txt --http-method POST --threads 25 --delay 200

sample output

ssrfuzz :: Server-Side Request Forgery Fuzzer [network] https://example.com/fetch?url= -> injecting SSRF payloads[network] SSRF candidate: https://example.com/fetch?url=http://203.0.113.10/  status=200 len=1462[scheme]  https://example.com/api?proxy= -> injecting scheme payloads[scheme]  SSRF candidate: https://example.com/api?proxy=gopher://203.0.113.10:11211/  status=500 len=94[crlf]    https://example.com/%0d%0aSet-Cookie:ssrf=1 -> header injecteddone: 2 SSRF candidates, 1 CRLF candidate written to ssrfuzz-output/

guidance

Choosing ssrfuzz

Use ssrfuzz when you have URLs with parameters and want to test them specifically for SSRF and CRLF. It needs parameterized inputs, so feed it a crawler or parameter-discovery output rather than bare hostnames. For broad template-based testing, pair it with a general scanner.

nuclei

Template-based scanner with SSRF checks among many. ssrfuzz focuses entirely on SSRF and CRLF fuzzing depth.

ffuf

General request fuzzer. ssrfuzz ships SSRF-specific payloads and scheme/network logic out of the box.

faq

ssrfuzz questions

A file of URLs that already contain parameters, passed with --domains. ssrfuzz injects SSRF and CRLF payloads into each parameter value, so feed it output from a crawler or a parameter-discovery stage rather than bare hostnames.

Run ssrfuzz yourself

A file of parameterized URLs feeds ssrfuzz, which injects SSRF and CRLF payloads and writes the findings as a queryable output.

Run ssrfuzz in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target-domains

FILE

--domains

File of URLs with parameters to fuzz.

http-method

STRING

--http-method

HTTP method, GET or POST (default "GET").

threads

STRING

--threads

Number of threads to run ssrfuzz on (default 50).

delay

STRING

--delay

Time each thread waits between requests, in milliseconds (default 100).

skip-crlf

BOOLEAN

--skip-crlf

Skip CRLF fuzzing.

skip-scheme

BOOLEAN

--skip-scheme

Skip scheme fuzzing.

skip-network

BOOLEAN

--skip-network

Skip network fuzzing.

slack-webhook

STRING

--slack-webhook

Slack webhook to post findings to a channel.

Name

Type

Flag

Description

delay

STRING

--delay

Time each thread waits between requests, in milliseconds (default 100).

STRING

--cookie

Cookie to send with each request.

threads

STRING

--threads

Number of threads to run ssrfuzz on (default 50).

timeout

STRING

--timeout

Seconds to wait before closing a connection that has hung (default 10).

verbose

STRING

--verbose

Enable verbose output.

crlf-path

STRING

--crlf-path

Add CRLF payloads to every available path (e.g. example.com/%0Atest.php).

skip-crlf

BOOLEAN

--skip-crlf

Skip CRLF fuzzing.

http-method

STRING

--http-method

HTTP method, GET or POST (default "GET").

skip-scheme

BOOLEAN

--skip-scheme

Skip scheme fuzzing.

skip-network

BOOLEAN

--skip-network

Skip network fuzzing.

slack-webhook

STRING

--slack-webhook

Slack webhook to post findings to a channel.

target-domains

FILE

--domains

File of URLs with parameters to fuzz.

custom-user-agent

STRING

--user-agent

User agent for requests (defaults to a Chrome on Linux string).

ssrfuzz :: Server-Side Request Forgery Fuzzer [network] https://example.com/fetch?url= -> injecting SSRF payloads[network] SSRF candidate: https://example.com/fetch?url=http://203.0.113.10/ status=200 len=1462[scheme] https://example.com/api?proxy= -> injecting scheme payloads[scheme] SSRF candidate: https://example.com/api?proxy=gopher://203.0.113.10:11211/ status=500 len=94[crlf] https://example.com/%0d%0aSet-Cookie:ssrf=1 -> header injecteddone: 2 SSRF candidates, 1 CRLF candidate written to ssrfuzz-output/

Fuzz URL parameters for SSRF and CRLF vulnerabilities

What ssrfuzz does

Where ssrfuzz fits

Find SSRF in URL parameters

Reach cloud metadata and internal services

Catch CRLF injection in the same run

Scope and throttle the scan

Stream findings to Slack

ssrfuzz inputs and flags

Run ssrfuzz

Choosing ssrfuzz

nuclei

ffuf

ssrfuzz questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run ssrfuzz yourself

Fuzz URL parameters for SSRF and CRLF vulnerabilities

What ssrfuzz does

Where ssrfuzz fits

Find SSRF in URL parameters

Reach cloud metadata and internal services

Catch CRLF injection in the same run

Scope and throttle the scan

Stream findings to Slack

ssrfuzz inputs and flags

Run ssrfuzz

Choosing ssrfuzz

nuclei

ffuf

ssrfuzz questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run ssrfuzz yourself