Automated open-redirect scanning, plus a client-side SSRF payload toolkit with ready-to-run commands.
This tool has two halves. The Open-Redirect Scanner fires a rich library of bypass payloads at one parameter - using a benign, non-routable external canary - and reports exactly where the canary lands: a Location-header redirect (confirmed), a meta-refresh or JavaScript sink (likely client-side), or plain body reflection. Redirects are never followed, so the canary is never actually contacted.
The SSRF Toolkit is a client-side generator (it runs entirely in your browser and sends nothing anywhere). Give it the injection point, an internal target and an optional out-of-band host, and it produces a full SSRF payload arsenal - loopback & IP-encoding bypasses, cloud-metadata endpoints (AWS/GCP/Azure/Alibaba/DO/Oracle, with the headers each needs), protocol smuggling (gopher/dict/file) and WAF-encoding tricks - plus ready-to-run ffuf / curl / Burp Intruder commands and a downloadable wordlist.
By design, no SSRF attack traffic originates from our servers - the dangerous payloads are handed to you to run from an environment you are authorised to test.
//, /\, @-confusion, scheme & slash tricks, suffix domains and more.Run it from your dashboard.
Create free account Sign in Use via APINo. The open-redirect scan only sends benign external-canary payloads (and never follows redirects). All SSRF payloads - internal IPs, cloud metadata, gopher/file - are generated client-side for you to run from a machine you are authorised to test; nothing leaves our servers.
Open-redirect testing is benign and automatable (a few normal GETs with a harmless canary). Real SSRF requires sending attack traffic to a target and observing out-of-band callbacks - that belongs on your own tooling, so we generate the payloads and commands instead.