# SSRF-King | SSRF Plugin For Burp Automates SSRF Detection In All Of The Request **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming\ **Created:** [January 31, 2021, 10:40am UTC](https://onehack.st/t/ssrf-king-ssrf-plugin-for-burp-automates-ssrf-detection-in-all-of-the-request/171439 "2021-01-31T10:40:29Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\ **Post date:** [January 31, 2021, 10:40am UTC](https://onehack.st/t/ssrf-king-ssrf-plugin-for-burp-automates-ssrf-detection-in-all-of-the-request/171439/1 "2021-01-31T10:40:30Z")
![image](https://onehack.st/uploads/default/original/3X/7/9/79692d00aff2404bea4979e0d663c6882d263ab4.jpeg) SSRF plugin for burp that Automates SSRF Detection in all of the Request [![alt text](https://camo.githubusercontent.com/dc2c59ae7cce1bf1f96d54f23bca886efabf7b4ad5c71116ffb67f8957c33e9f/68747470733a2f2f696d6167652e666c617469636f6e2e636f6d2f69636f6e732f706e672f3132382f313332302f313332303435372e706e67)](https://camo.githubusercontent.com/dc2c59ae7cce1bf1f96d54f23bca886efabf7b4ad5c71116ffb67f8957c33e9f/68747470733a2f2f696d6167652e666c617469636f6e2e636f6d2f69636f6e732f706e672f3132382f313332302f313332303435372e706e67) **If you are facing any problems or would like a new feature that is not listed below** **Please create a new issue below in this form** **[Create New Issue](https://github.com/ethicalhackingplayground/ssrf-king/issues/new)** ### Upcoming Features Checklist - ✔ It will soon have a user Interface to specifiy your own call back payload - It will soon be able to test Json & XML - Test for SMTP SSRF ### How to Install/Build - `git clone https://github.com/ethicalhackingplayground/ssrf-king` - `gradle build` - Now the file “ssrf-king.jar” could be found under build/libs which can then be imported Burpsuite. - Alternatively, goto [releases](https://github.com/ethicalhackingplayground/ssrf-king/releases) to download the compiled file. ### Features - ✔ Test all of the request for any external interactions. - ✔ Checks to see if any interactions are not the users IP if it is, it’s an open redirect. - ✔ Alerts the user for any external interactions with information such as: - Endpoint Vulnerable - Host - Location Found It also performs the following tests based on this research: **Reference:** > **[Cracking the lens: targeting HTTP's hidden attack-surface](https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface)** > > Modern websites are browsed through a lens of transparent systems built to enhance performance, extract analytics and supply numerous additional services. This almost invisible attack surface has been GET [http://burpcollab/some/endpoint](http://burpcollab/some/endpoint) HTTP/1.1 Host: [example.com](http://example.com) … and GET @burpcollab/some/endpoint HTTP/1.1 Host: [example.com](http://example.com) … and GET /some/endpoint HTTP/1.1 Host: [example.com:80](http://example.com:80)@burpcollab … and GET /some/endpoint HTTP/1.1 Host: burpcollab … and GET /some/endpoint HTTP/1.1 Host: [example.com](http://example.com) X-Forwarded-Host: burpcollab … ### Contributors [![](https://camo.githubusercontent.com/4cfdddc5df8a8ee673195e50c2dc9d23877fa087da4eb28646dec0d77347b7ab/68747470733a2f2f636f6e747269622e726f636b732f696d6167653f7265706f3d6574686963616c6861636b696e67706c617967726f756e642f737372662d6b696e67)](https://github.com/ethicalhackingplayground/ssrf-king/graphs/contributors) ### Scanning Options - ✔ Supports Both Passive & Active Scanning. ### Example - Load the website you want to test. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ss-1.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ss-1.PNG) - Add it as an inscope host in burp. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ss-2.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ss-2.PNG) - Load the plugin. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ss-3.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ss-3.PNG) - Keep note of the Burp Collab Payload. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ss-4.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ss-4.PNG) - Passively crawl the page, ssrf-king test everything in the request on the fly. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ssf-5.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ssf-5.PNG) - When it finds a vulnerabilitiy it logs the information and adds an alert. [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ssrf-6.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ssrf-6.PNG) **From here onwards you would fuzz the parameter to test for SSRF.** [![GitHub Logo](https://github.com/ethicalhackingplayground/ssrf-king/raw/main/Pictures/ssrf-7.PNG)](https://github.com/ethicalhackingplayground/ssrf-king/blob/main/Pictures/ssrf-7.PNG) ### Video Demonstration [![Watch the video](https://camo.githubusercontent.com/b271291ea483062bfe3c92dec248b96d929eb193d4a6d357244c243c679bc1e7/68747470733a2f2f692e696d6775722e636f6d2f635944366766452e706e67)](https://www.youtube.com/watch?v=oIkPpgqKfsg) ## GitHub: > **[GitHub - ethicalhackingplayground/ssrf-king: SSRF plugin for burp Automates SSRF Detection in...](https://github.com/ethicalhackingplayground/ssrf-king)** > > SSRF plugin for burp Automates SSRF Detection in all of the Request