This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack

国光的手把手带你用 SSRF 打穿内网靶场源码

In this repository I'll host my research and methodologies for auditing vulnerabilities

WebHook for Red Team

PHP Implementation of SafeURL (Anti-SSRF lib)

Server-Side Request Forgery (SSRF) protection plugin for HTTPlug

SSRF Protection Library for PHP cURL extension

Intentionally vulnerable healthcare patient portal demonstrating all OWASP Top 10 (2021) vulnerabilities with real-time toggling between exploitable and hardened code paths. Built with raw PHP, MySQL, and Apache.

Hack a WordPress Server which is vulnerable to Server side Request Forgery, learn why the vulnerability is critical to address in your own systems, and how it's typically mitigated!

SSRF & RCE report log with discord webhook.

A web challenge that was available during SigSegV2 CTF (2019)

🔒 An interactive PHP-based learning platform demonstrating common web security vulnerabilities (XSS, SQLi, CSRF, etc.) and their secure implementations. Perfect for security education and penetration testing practice.

A simple SSRF-Demo implemented in php.

BlackCat Core — Web3-backed TrustKernel security: HTTPS-only request hardening, fail-closed runtime config, and guarded DB/crypto entrypoints.

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

Pikachu enhanced Web security lab with JWT, CORS, Clickjacking, Session Fixation, Host Header and Docker Lab.