FUZZING

PRIMARY CATEGORY → WEB PENTESTING

Interesting Extensions

In addition to Server-Side Programming Language resources ( e.g. .php, .aspx … )

.html
.txt
.bak
.conf

Username Wordlists

/usr/share/seclist/Usernames/ directory

/usr/share/seclist/Usernames/xato-net-10-million-usernames.txt

Allowed Extensions

Wordlists

/usr/share/seclists/Discovery/Web-Content/web-extensions.txt
/usr/share/seclists/Discovery/Web-Content/web-extensions-big.txt

Ffuf

ffuf -v -t <THREADS> -w '<WORDLIST>' -u 'http[s]://<TARGET>/index.FUZZ'

e.g.

ffuf -v -t 200 -w '/usr/share/seclist/Discovery/Web-Content/web-extensions.txt' -u 'http://www.domain.tld:8080/index.FUZZ'

Web Application Content

Wordlists

Wordlists

/usr/share/seclist/Discovery/Web-Content/common.txt
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt
/usr/share/seclist/Discovery/Web-Content/raft-medium-directories.txt
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
/usr/share/seclist/Discovery/Web-Content/raft-large-directories.txt
/usr/share/seclist/Discovery/Web-Content/big.txt

Ffuf

Ffuf

Only Directories

ffuf -t <THREADS> -w '<WORDLIST>' -u 'http[s]://<TARGET>/FUZZ'

Directories and Files

ffuf -t <THREADS> -w '<WORDLIST>' -e '.<EXT1>,<EXT2>' 'http[s]://<TARGET>/FUZZ'

Recursion

ffuf -t <THREADS> -w '<WORDLIST>' -v -e '.<EXT>' -recursion -recursion-depth <INTEGER> -u 'http[s]://<TARGET>/FUZZ'

Gobuster

Gobuster

Only Directories

Long Format

gobuster dir --add-slash --threads <INT> --output <OUTPUT_FILE> --wordlist <WORDLIST> --url <URL>

Info

The add-slash argument option ensures that, for an existent directory, the Web Server does not respond with a 3XX Status Code followed by a 200

As this option causes the URL to end with a slash, no redirection will be performed and the client will directly receive a 200 Status Code

As a summary:

Without add-slash → 3XX Status Code followed by a 200

With add-slash → 200 Status Code directly

Short Format

gobuster dir -ft <INT> -o <OUTPUT_FILE> -w <WORDLIST> -u <URL>

Directories and Files

Long Format

gobuster dir --threads <INT> --output <OUTPUT_FILE> --extensions <EXT1,EXT2,EXTN> --wordlist <WORDLIST> --url <URL>

The --extension argument option adds the extensions specified for each resource in the wordlist

Short Format

gobuster dir -t <INT> -o <OUTPUT_FILE> -x <EXT1,EXT2,EXTN> -w <WORDLIST> -u <URL>

Backup Files

gobuster dir --threads 200 --output '<OUTPUT_FILE>' --extensions '<EXT1,EXT2,EXTN>' --wordlist '<WORDLIST>' --url '<URL>' --discover-backup

Feroxbuster

Feroxbuster

Only Directories

Long Format

feroxbuster --add-slash --threads <INT> --output <OUTPUT_FILE> --wordlist <WORDLIST> --url <URL>

Short Format

feroxbuster -f -t <INT> -o <OUTPUT_FILE> -w <WORDLIST> -u <URL>

Directories and Files

Long Format

feroxbuster --threads <INT> --output <OUTPUT_FILE> --extensions <EXT1,EXT2,EXTN> --wordlist <WORDLIST> --url <URL>

Short Format

feroxbuster -t <int> -o <OUTPUT_FILE> -x <EXT1,EXT2,EXTN> -w <WORDLIST> -u <URL>

Wfuzz

Wfuzz

Only Directories

wfuzz -c --hc <STATUS_CODE> -t <INT> -f <OUTPUT_FILE>,<PRINTER> -w <WORDLIST> http[s]://<TARGET>[:<PORT>]/FUZZ/

e.g.

wfuzz -c --hc 404 -t 200 -f fullWebScan.json,json -w /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-medium.txt https://domain.com:8000/FUZZ/

To print the available output formats →

wfuzz -e printers # CSV - Field - HTML - JSON - RAW

Only Files

wfuzz -c --hc <STATUS_CODE> -t <INT> -f <OUTPUT_FILE>,<PRINTER> -z list,.<EXT1>,.<EXT2>,.<EXTN> -w <WORDLIST> http[s]://<TARGET>[:<PORT>]/FUZZ

e.g.

wfuzz -c --hc 404 -t 200 -f fullWebScan -z list,.php,.html,.js -w /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-big.txt https://example.com/FUZZ

To print the payloads used in the parameter -z →

wfuzz -e payloads

Directories and Files

wfuzz -c --hc <STATUS_CODE> -t <INT> -f <OUTPUT_FILE>,<PRINTER> -z list,,.<EXT1>,.<EXT2>,.<EXTN> -w <WORDLIST> http[s]://<TARGET>:[<PORT>]/FUZZ

e.g.

wfuzz -c --hc 404 -t 200 -f fullWebScan.html,html -z list,,.asp,.aspx,.txt -w /usr/share/seclist/Discovery/Web-Content/directory-list-2.3-small.txt https://domain.com:1234/FUZZ/

HTTP Parameters

Wordlists

/usr/share/seclist/Discovery/Web-Content/common.txt
/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

GET

Ffuf

Ffuf

ffuf -t <THREADS> -v -w '<WORDLIST>' -u '<http[s]://<DOMAIN.TLD>/<PATH>?FUZZ=<VALUE>'

e.g.

ffuf -t 200 -v -w /usr/share/seclist/Discovery/Web-Content/burp-parameter-names.txt -u 'https://domain.com/admin/admin.php?FUZZ=test'

POST

Ffuf

Ffuf

ffuf -t <THREADS> -v -w '<WORDLIST>' -X POST -d 'FUZZ=<VALUE>' -H 'Content-Type: application/x-www-form-urlencoded' -u 'http[s]://'

e.g.

ffuf -t 200 -v -w /usr/share/seclists/Discovery/Weg-Content/burp-parameter-names.txt -X POST -d 'FUZZ=<VALUE>' -H 'Content-Type: application/x-www-form-urlencoded' -u 'https://domain.com/admin/admin.php'

Virtual Hosts

Wordlists

/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
/usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

Ffuf

ffuf -t <THREADS> -v -w '<WORDLIST>' -H 'Host: FUZZ.<DOMAIN.TLD>' -u 'http[s]://<TARGET>:<PORT>' -mc all

Gobuster

IP Address in URL

gobuster vhost --threads <INT> --append-domain --domain <DOMAIN> --output <OUTPUT_FILE> --wordlist <WORDLIST> --url http[s]://<IP_ADDRESS>[:<PORT>]

e.g.

gobuster vhost --threads 200 --append-domain --domain domain.com --output vhostFullScan --wordlist  /usr/share/seclist/Discovery/DNS/subdomains-top1million-110000.txt --url https://10.10.133.56:1234

Domain in URL

gobuster vhost --threads <INT> --append-domain --output <OUTPUT_FILE> --wordlist <WORDLIST> --url http[s]://<DOMAIN>[:<PORT>]

e.g.

gobuster vhost --threads 200 --append-domain --output vhostFullScan --wordlist /usr/share/seclist/Discovery/DNS/subdomains-top1million-110000.txt --url https://domain.com

Wfuzz

IP Address in URL

If the domain does not resolve to the Server’s IP Address, e.g. CloudFlare’s Proxy Enabled ☁️

wfuzz -c --hc <STATUS_CODE> -t <INT> -f <OUTPUT_FILE> -H "Host:FUZZ.<DOMAIN>" -w <WORDLIST> http://<IP_ADDRESS>[:<PORT>]

e.g.

wfuzz -c --hc 404 -t 200 -f outputFile -H "Host:FUZZ.domain.com" -w /usr/share/seclist/Discovery/DNS/subdomains-top1million-110000.txt http://10.129.26.48:5555

Domain in URL

Unlike the above situation, the following one applies if the domain resolves to the Server’s IP Address

wfuzz -c --hc <STATUS_CODE> -t <INT> -f <OUTPUT_FILE> -w <WORDLIST> http://FUZZ.<DOMAIN>[:<PORT>]

e.g.

wfuzz -c --hc 404 -t 200 -f vhostFullScan -w /usr/share/seclist/Discovery/DNS/subdomains-top1million-110000.txt https://FUZZ.domain.com

IMPORTANT

In additions to the status code, to filter by other aspects of the HTTP Response, proceed as follows

The number of:

--hl → Lines in the Response Body

--hw → Words in the Response Body

--hh → Characters in the Response Body

Subdomains

Wordlists

/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
/usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

Ffuf

ffuf -v -w '<WORDLIST>' -u 'http[s]://FUZZ.<DOMAIN>.<TLD>'

Gobuster

gobuster dns --domain '<DOMAIN>' -w '<WORDLIST>'

APIs

Webfuzz_api

Webfuzz_api

Setup

git clone https://github.com/PandaSt0rm/webfuzz_api.git Webfuzz_api
cd !$ && python3 -m venv .venv
. !$/bin/activate && pip3 install -r requirements.txt

Usage

python3 api_fuzzer.py '<TARGET>'

e.g.

python3 api_fuzzer.py http://10.10.10.5:8888

Field Manual

Explorer

FUZZING

PRIMARY CATEGORY → WEB PENTESTING

Interesting Extensions

Username Wordlists

Allowed Extensions

Wordlists

Ffuf

Web Application Content

Wordlists

Ffuf

Only Directories

Directories and Files

Recursion

Gobuster

Only Directories

Directories and Files

Backup Files

Feroxbuster

Only Directories

Directories and Files

Wfuzz

Only Directories

Only Files

Directories and Files

HTTP Parameters

Wordlists

GET

Ffuf

POST

Ffuf

Virtual Hosts

Wordlists

Ffuf

Gobuster

IP Address in URL

Domain in URL

Wfuzz

IP Address in URL

Domain in URL

Subdomains

Wordlists

Ffuf

Gobuster

APIs

Webfuzz_api

Setup

Usage

Graph View

Table of Contents

Backlinks