Server-Side Request Forgery (SSRF) Scanner
S9R (SSRFSCANNER) is a specialized Server-Side Request Forgery (SSRF) scanner.
Overview
S9R (SSRFSCANNER) is a specialized tool designed to detect both full and blind Server-Side Request Forgery (SSRF) vulnerabilities. SSRF (CWE-918) is often considered a high-severity issue due to its potential to bypass security controls, access internal resources, or perform unauthorized actions on behalf of the server.
S9R’s comprehensive approach helps identify these critical security flaws effectively.
Usage Examples
You can specify a list of target URLs for S9R to check for Server-Side Request Forgery vulnerabilities. Optionally, you may configure any settings you’d like. Afterward, simply click on Scan to launch your scan.
Shortly after your scan has been launched, you will be redirected to the page to view your pending scan.
You must provide a list of target URLs to scan for vulnerabilities, not base URLs or root domains. A few examples:
Correct:
https://example.com/path/to/scan?param1=xyz¶m2=xyz https://api.example.com/path/to/scan2Incorrect:
https://example.com/ https://app.example.com/Capabilities
S9R is an advanced Server-Side Request Forgery (SSRF) scanner equipped with the following capabilities:
Limitations
There are currently no limitations reported for S9R.
Best Practices
We recommend you to follow the best practices that we’ve outlined in detail.
Was this page helpful?