Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ssrf-king — SSRF plugin for burp Automates SSRF Detection in all of the Request | Kitploit
Tools/GitHubGitHub/ethicalhackingplayground/ssrf-king
Vulnerability ScannersAPI Security TestingWeb SecurityPenetration Testing
GitHubethicalhackingplayground/ssrf-king

ssrf-king

SSRF plugin for burp Automates SSRF Detection in all of the Request

View Repository
6335965 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🔥 ssrf-king 🔥

License: MIT

v1.12 Latest

SSRF plugin for burp that Automates SSRF Detection in all of the Request

alt text

If you are facing any problems or would like a new feature that is not listed below Please create a new issue below in this form

Create New Issue

Upcoming Features Checklist

  • ✔️ It will soon have a user Interface to specifiy your own call back payload
  • It will soon be able to test Json & XML
  • Test for SMTP SSRF

How to Install/Build

  • git clone https://github.com/ethicalhackingplayground/ssrf-king
  • gradle build
  • Now the file "ssrf-king.jar" could be found under build/libs which can then be imported Burpsuite.
  • Alternatively, goto releases to download the compiled file.

    • Features

    • ✔️ Test all of the request for any external interactions.
    • ✔️ Checks to see if any interactions are not the users IP if it is, it's an open redirect.
    • ✔️ Alerts the user for any external interactions with information such as:
      • Endpoint Vulnerable
      • Host
      • Location Found

    It also performs the following tests based on this research:

    Reference:

    https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface

    root@kitploit:~
    GET http://burpcollab/some/endpoint HTTP/1.1
Host: example.com
...

    and

    root@kitploit:~
    GET @burpcollab/some/endpoint HTTP/1.1
Host: example.com
...

    and

    root@kitploit:~
    GET /some/endpoint HTTP/1.1
Host: example.com:80@burpcollab
...

    and

    root@kitploit:~
    GET /some/endpoint HTTP/1.1
Host: burpcollab
...

    and

    root@kitploit:~
    GET /some/endpoint HTTP/1.1
Host: example.com
X-Forwarded-Host: burpcollab
...

    Contributors

    Scanning Options

    • ✔️ Supports Both Passive & Active Scanning.

    Example

    • Load the website you want to test.

    GitHub Logo

    • Add it as an inscope host in burp.

    GitHub Logo

    • Load the plugin.

    GitHub Logo

    • Keep note of the Burp Collab Payload.

    GitHub Logo

    • Passively crawl the page, ssrf-king test everything in the request on the fly.

    GitHub Logo

    • When it finds a vulnerabilitiy it logs the information and adds an alert.

    GitHub Logo

    From here onwards you would fuzz the parameter to test for SSRF.

    GitHub Logo

    Video Demonstration

    Watch the video

    If you get a bounty please support by buying me a coffee


    Buy Me A Coffee
    Download Tool