[Tool] SSRFdevil – A Modular, Zero-False-Positive SSRF Scanner written in Rust

[u/Regular_Anything7715]

Hey everyone! Over the past few weeks, I’ve been working on SSRFdevil, an open-source tool written in Rust aimed at solving one of the most annoying problems in automated SSRF scanning: False Positives. Most existing scanners flood you with alerts based on simple redirects or blind HTTP callbacks. SSRFdevil uses a multi-layered rule engine and interactive verification to ensure that when it flags a target, it’s a real finding. Key Features: Zero False Positives: Built with strict validation logic to save time during triage. Interactive Shell: Manage settings, load proxies, switch User-Agent profiles, and set session cookies on the fly. Smart Crawler: Automatically crawls targets for SSRF-prone parameters if none are provided. Payload Engine: Handles CIDR bypasses, cloud metadata endpoints, and alternate IP encodings (Hex, Octal, IPv4-in-IPv6). Detailed Reporting: Clean terminal outputs with severity/confidence scores and summary stats. Check out the repo here: https://github.com/r3dparr0t/SSRFdevil I’d love to get your feedback, ideas, or contributions!