Can ssrfuzz find SSRF against AWS or GCP metadata endpoints?

Yes. Network fuzzing aims payloads at internal and link-local addresses, including the 169.254.169.254 metadata endpoint that returns cloud credentials on AWS and GCP. A parameter that fetches that address and echoes the response is a confirmed SSRF.

Does ssrfuzz do CRLF fuzzing, and how does it compare to crlfuzz?

ssrfuzz runs CRLF alongside SSRF: --crlf-path adds CRLF payloads to every path, and --skip-crlf turns it off. crlfuzz is a dedicated CRLF scanner. Use ssrfuzz for combined coverage; use crlfuzz when CRLF is the whole job.

Which fuzzing categories does it run, and can I narrow them?

Three: scheme fuzzing, network fuzzing, and CRLF injection. Drop any with --skip-scheme, --skip-network, or --skip-crlf to keep a run focused.

Does ssrfuzz support POST and authenticated targets?

Set --http-method POST to fuzz POST parameters, and pass --cookie to carry a session behind login. --user-agent overrides the default browser string when a target filters on it.

Is SSRF the same as CSRF?

No. SSRF makes the server issue requests to addresses an attacker controls; CSRF tricks a victim browser into sending an authenticated request. ssrfuzz tests SSRF only.

Updated Jul 15, 2026

Vulnerabilities

Fuzz parameterized URLs for SSRF and CRLF

SSRF and CRLF fuzzer for parameterized URL lists.

Find SSRF in URL parameters Reach cloud metadata and internal services Catch CRLF injection in the same run

overview

What ssrfuzz does

ssrfuzz reads parameterized URLs from --domains, swaps each value for an SSRF or CRLF payload, and watches for responses that show the server fetched an attacker-chosen address.

Reach for it when a crawler or parameter-discovery stage already produced candidates. Skip categories with --skip-scheme, --skip-network, or --skip-crlf; switch GET/POST via --http-method.

nuclei covers template SSRF checks among many classes. ffuf is a general request fuzzer. ssrfuzz ships scheme, network, and CRLF logic aimed at loopback, internals, and cloud metadata.

source github.com/ryandamour/ssrfuzz

use cases

Where ssrfuzz fits

Find SSRF in URL parameters

Fuzz parameterized URLs with SSRF payloads to surface endpoints where the server fetches an attacker-controlled address.

Reach cloud metadata and internal services

Point network and scheme fuzzing at loopback, internal ranges, and metadata endpoints like 169.254.169.254 to test whether a parameter can pull AWS or GCP credentials.

Catch CRLF injection in the same run

Add CRLF payloads to available paths with --crlf-path so header injection surfaces alongside SSRF instead of in a separate scan.

Scope and throttle the scan

Skip scheme or network fuzzing, choose GET or POST, and set threads and delay so the run matches the app's request shapes and its rate limits.

Stream findings to Slack

Give ssrfuzz a Slack webhook so confirmed hits post to a channel while the scan runs, not only when it finishes.

reference

ssrfuzz inputs and flags

13 inputs

Name	Type	Flag	Description
target-domains	FILE	--domains	File of URLs with parameters to fuzz.
http-method	STRING	--http-method	HTTP method, GET or POST (default "GET").
threads	STRING	--threads	Number of threads to run ssrfuzz on (default 50).
delay	STRING	--delay	Time each thread waits between requests, in milliseconds (default 100).
skip-crlf	BOOLEAN	--skip-crlf	Skip CRLF fuzzing.
skip-scheme	BOOLEAN	--skip-scheme	Skip scheme fuzzing.
skip-network	BOOLEAN	--skip-network	Skip network fuzzing.
slack-webhook	STRING	--slack-webhook	Slack webhook to post findings to a channel.

Showing key inputs. ssrfuzz exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
delay	STRING	--delay	Time each thread waits between requests, in milliseconds (default 100).
cookie	STRING	--cookie	Cookie to send with each request.
threads	STRING	--threads	Number of threads to run ssrfuzz on (default 50).
timeout	STRING	--timeout	Seconds to wait before closing a connection that has hung (default 10).
verbose	STRING	--verbose	Enable verbose output.
crlf-path	STRING	--crlf-path	Add CRLF payloads to every available path (e.g. example.com/%0Atest.php).
skip-crlf	BOOLEAN	--skip-crlf	Skip CRLF fuzzing.
http-method	STRING	--http-method	HTTP method, GET or POST (default "GET").
skip-scheme	BOOLEAN	--skip-scheme	Skip scheme fuzzing.
skip-network	BOOLEAN	--skip-network	Skip network fuzzing.
slack-webhook	STRING	--slack-webhook	Slack webhook to post findings to a channel.
target-domains	FILE	--domains	File of URLs with parameters to fuzz.
custom-user-agent	STRING	--user-agent	User agent for requests (defaults to a Chrome on Linux string).

example

Run ssrfuzz

ssrfuzz · command

# fuzz a list of parameterized URLs for SSRF and CRLF, POST bodies, throttledssrfuzz --domains params.txt --http-method POST --threads 25 --delay 200

sample output

ssrfuzz :: Server-Side Request Forgery Fuzzer [network] https://example.com/fetch?url= -> injecting SSRF payloads[network] SSRF candidate: https://example.com/fetch?url=http://203.0.113.10/  status=200 len=1462[scheme]  https://example.com/api?proxy= -> injecting scheme payloads[scheme]  SSRF candidate: https://example.com/api?proxy=gopher://203.0.113.10:11211/  status=500 len=94[crlf]    https://example.com/%0d%0aSet-Cookie:ssrf=1 -> header injecteddone: 2 SSRF candidates, 1 CRLF candidate written to ssrfuzz-output/

guidance

Choosing ssrfuzz

Use when you have parameterized URLs and want dedicated SSRF and CRLF depth. Feed crawler or parameter-discovery output, not bare hostnames. Pair with nuclei for broader template coverage; prefer crlfuzz when CRLF alone is the job.

nuclei

Template-based scanner with SSRF checks among many. ssrfuzz focuses on SSRF and CRLF fuzzing depth.

ffuf

General request fuzzer. ssrfuzz ships SSRF-specific payloads plus scheme and network logic.

faq

ssrfuzz questions

A file of URLs that already contain parameters, passed with --domains. ssrfuzz injects SSRF and CRLF payloads into each parameter value, so feed crawler or parameter-discovery output rather than bare hostnames.

Run ssrfuzz yourself

A file of parameterized URLs feeds ssrfuzz, which injects SSRF and CRLF payloads and writes the findings as a queryable output.

Run ssrfuzz in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target-domains

FILE

--domains

File of URLs with parameters to fuzz.

http-method

STRING

--http-method

HTTP method, GET or POST (default "GET").

threads

STRING

--threads

Number of threads to run ssrfuzz on (default 50).

delay

STRING

--delay

Time each thread waits between requests, in milliseconds (default 100).

skip-crlf

BOOLEAN

--skip-crlf

Skip CRLF fuzzing.

skip-scheme

BOOLEAN

--skip-scheme

Skip scheme fuzzing.

skip-network

BOOLEAN

--skip-network

Skip network fuzzing.

slack-webhook

STRING

--slack-webhook

Slack webhook to post findings to a channel.

Name

Type

Flag

Description

delay

STRING

--delay

Time each thread waits between requests, in milliseconds (default 100).

STRING

--cookie

Cookie to send with each request.

threads

STRING

--threads

Number of threads to run ssrfuzz on (default 50).

timeout

STRING

--timeout

Seconds to wait before closing a connection that has hung (default 10).

verbose

STRING

--verbose

Enable verbose output.

crlf-path

STRING

--crlf-path

Add CRLF payloads to every available path (e.g. example.com/%0Atest.php).

skip-crlf

BOOLEAN

--skip-crlf

Skip CRLF fuzzing.

http-method

STRING

--http-method

HTTP method, GET or POST (default "GET").

skip-scheme

BOOLEAN

--skip-scheme

Skip scheme fuzzing.

skip-network

BOOLEAN

--skip-network

Skip network fuzzing.

slack-webhook

STRING

--slack-webhook

Slack webhook to post findings to a channel.

target-domains

FILE

--domains

File of URLs with parameters to fuzz.

custom-user-agent

STRING

--user-agent

User agent for requests (defaults to a Chrome on Linux string).

ssrfuzz :: Server-Side Request Forgery Fuzzer [network] https://example.com/fetch?url= -> injecting SSRF payloads[network] SSRF candidate: https://example.com/fetch?url=http://203.0.113.10/ status=200 len=1462[scheme] https://example.com/api?proxy= -> injecting scheme payloads[scheme] SSRF candidate: https://example.com/api?proxy=gopher://203.0.113.10:11211/ status=500 len=94[crlf] https://example.com/%0d%0aSet-Cookie:ssrf=1 -> header injecteddone: 2 SSRF candidates, 1 CRLF candidate written to ssrfuzz-output/

Fuzz parameterized URLs for SSRF and CRLF

What ssrfuzz does

Where ssrfuzz fits

Find SSRF in URL parameters

Reach cloud metadata and internal services

Catch CRLF injection in the same run

Scope and throttle the scan

Stream findings to Slack

ssrfuzz inputs and flags

Run ssrfuzz

Choosing ssrfuzz

nuclei

ffuf

ssrfuzz questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run ssrfuzz yourself

Fuzz parameterized URLs for SSRF and CRLF

What ssrfuzz does

Where ssrfuzz fits

Find SSRF in URL parameters

Reach cloud metadata and internal services

Catch CRLF injection in the same run

Scope and throttle the scan

Stream findings to Slack

ssrfuzz inputs and flags

Run ssrfuzz

Choosing ssrfuzz

nuclei

ffuf

ssrfuzz questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run ssrfuzz yourself