Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Fuzz parameterized URLs for SSRF and CRLF

SSRF and CRLF fuzzer for parameterized URL lists.

Agent
Find SSRF in URL parametersReach cloud metadata and internal servicesCatch CRLF injection in the same run

overview

What ssrfuzz does

ssrfuzz reads parameterized URLs from --domains, swaps each value for an SSRF or CRLF payload, and watches for responses that show the server fetched an attacker-chosen address.

Reach for it when a crawler or parameter-discovery stage already produced candidates. Skip categories with --skip-scheme, --skip-network, or --skip-crlf; switch GET/POST via --http-method.

nuclei covers template SSRF checks among many classes. ffuf is a general request fuzzer. ssrfuzz ships scheme, network, and CRLF logic aimed at loopback, internals, and cloud metadata.

source github.com/ryandamour/ssrfuzz

use cases

Where ssrfuzz fits

Find SSRF in URL parameters

Fuzz parameterized URLs with SSRF payloads to surface endpoints where the server fetches an attacker-controlled address.

Reach cloud metadata and internal services

Point network and scheme fuzzing at loopback, internal ranges, and metadata endpoints like 169.254.169.254 to test whether a parameter can pull AWS or GCP credentials.

Catch CRLF injection in the same run

Add CRLF payloads to available paths with --crlf-path so header injection surfaces alongside SSRF instead of in a separate scan.

Scope and throttle the scan

Skip scheme or network fuzzing, choose GET or POST, and set threads and delay so the run matches the app's request shapes and its rate limits.

Stream findings to Slack

Give ssrfuzz a Slack webhook so confirmed hits post to a channel while the scan runs, not only when it finishes.

reference

ssrfuzz inputs and flags

13 inputs
NameTypeFlagDescription
target-domainsFILE--domainsFile of URLs with parameters to fuzz.
http-methodSTRING--http-methodHTTP method, GET or POST (default "GET").
threadsSTRING--threadsNumber of threads to run ssrfuzz on (default 50).
delaySTRING--delayTime each thread waits between requests, in milliseconds (default 100).
skip-crlfBOOLEAN--skip-crlfSkip CRLF fuzzing.
skip-schemeBOOLEAN--skip-schemeSkip scheme fuzzing.
skip-networkBOOLEAN--skip-networkSkip network fuzzing.
slack-webhookSTRING--slack-webhookSlack webhook to post findings to a channel.

Showing key inputs. ssrfuzz exposes 13 inputs in total.

Full flag reference (13 inputs)
NameTypeFlagDescription
delaySTRING--delayTime each thread waits between requests, in milliseconds (default 100).
cookieSTRING--cookieCookie to send with each request.
threadsSTRING--threadsNumber of threads to run ssrfuzz on (default 50).
timeoutSTRING--timeoutSeconds to wait before closing a connection that has hung (default 10).
verboseSTRING--verboseEnable verbose output.
crlf-pathSTRING--crlf-pathAdd CRLF payloads to every available path (e.g. example.com/%0Atest.php).
skip-crlfBOOLEAN--skip-crlfSkip CRLF fuzzing.
http-methodSTRING--http-methodHTTP method, GET or POST (default "GET").
skip-schemeBOOLEAN--skip-schemeSkip scheme fuzzing.
skip-networkBOOLEAN--skip-networkSkip network fuzzing.
slack-webhookSTRING--slack-webhookSlack webhook to post findings to a channel.
target-domainsFILE--domainsFile of URLs with parameters to fuzz.
custom-user-agentSTRING--user-agentUser agent for requests (defaults to a Chrome on Linux string).

example

Run ssrfuzz

ssrfuzz · command
# fuzz a list of parameterized URLs for SSRF and CRLF, POST bodies, throttledssrfuzz --domains params.txt --http-method POST --threads 25 --delay 200
sample output
ssrfuzz :: Server-Side Request Forgery Fuzzer [network] https://example.com/fetch?url= -> injecting SSRF payloads[network] SSRF candidate: https://example.com/fetch?url=http://203.0.113.10/  status=200 len=1462[scheme]  https://example.com/api?proxy= -> injecting scheme payloads[scheme]  SSRF candidate: https://example.com/api?proxy=gopher://203.0.113.10:11211/  status=500 len=94[crlf]    https://example.com/%0d%0aSet-Cookie:ssrf=1 -> header injecteddone: 2 SSRF candidates, 1 CRLF candidate written to ssrfuzz-output/

guidance

Choosing ssrfuzz

Use when you have parameterized URLs and want dedicated SSRF and CRLF depth. Feed crawler or parameter-discovery output, not bare hostnames. Pair with nuclei for broader template coverage; prefer crlfuzz when CRLF alone is the job.

nuclei

Template-based scanner with SSRF checks among many. ssrfuzz focuses on SSRF and CRLF fuzzing depth.

ffuf

General request fuzzer. ssrfuzz ships SSRF-specific payloads plus scheme and network logic.

faq

ssrfuzz questions

A file of URLs that already contain parameters, passed with --domains. ssrfuzz injects SSRF and CRLF payloads into each parameter value, so feed crawler or parameter-discovery output rather than bare hostnames.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run ssrfuzz yourself

A file of parameterized URLs feeds ssrfuzz, which injects SSRF and CRLF payloads and writes the findings as a queryable output.

Open ssrfuzz in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.