xtawb

However, if only the intended URL is needed, one can do it by providing –efield url input. wfuzz -z range --zD 0-1 -u http://testphp.vulnweb.com/artists.php?artist=FUZZ --efield url --efield h

These can be manipulated using “–filter, –slice, –field and –efield” arguments. For example, to view raw responses of the payload sent and the complete HTTP request made, you can use “–efield r” option wfuzz -z range --zD 0-1 -u http://testphp.vulnweb.com/artists.php?artist=FUZZ --efield r

Filtering results There are many filters available to manipulate a payload or output. wfuzz --filter-help

Ignoring exceptions and errors Often while fuzzing, there are various errors and exceptions that a website can throw. “-Z” option can make wfuzz ignore these errors and exceptions. First, we run a normal subdomain fuzzing routine and then with -Z option: wfuzz -z list,support-web-none http://FUZZ.google.com/ wfuzz -z list,support-web-none -Z http://FUZZ.google.com/ As you could see, -Z ignores that error on the bottom. Further, any invalid response can also be hidden like so: wfuzz -z list,support-web-none -Z --hc “XXX” http://FUZZ.google.com/

Storing and restoring fuzz from recipes To make scanning easy, wfuzz can save and restore sessions using the “–dump-recipe” and “–recipe” flag. wfuzz -w wordlist/general/common.txt --dump-recipe /tmp/recipe --sc 200,301 http://testphp.vulnweb.com/FUZZ wfuzz --recipe /tmp/recipe

One can fuzz a website for directories by using MD5 output like so: wfuzz -z file,wordlist/general/common.txt,md5 http://testphp.vulnweb.com/FUZZ

Encoders Various encoders are available in wfuzz. One such encoder we saw earlier was md5. Other encoders can be viewed by using “-e” flag with encoders argument. wfuzz -e encoders

Printers and output Printers in wfuzz refers to all the formats a payload’s output can be processed as. It can be viewed using -e succeeded by printers argument. Furthermore, “-o” flag can specify the format of the output too wfuzz -e printers wfuzz -o json -w wordlist/general/common.txt http://testphp.vulnweb.com/FUZZ

Recursive fuzz -R switch can specify the levels of recursion while fuzzing directories or parameters. Recursion in simple terms means fuzzing at multiple different levels of directories like /dir/dir/dir etc In the following example, we are recursing at level 1 with a list inline containing 3 directories: admin, CVS and cgi-bin. Note how a directory with – in its name can be supplied inline wfuzz -z list,"admin-CVS-cgi\-bin" -R1 http://testphp.vulnweb.com/FUZZ

Authentication fuzz Wfuzz can also set authentication headers and provide means of authentication through HTTP requests. Flags: –basic: provides basic Username and Password auth –ntlm: windows auth –digest: webserver negotiation through digest access In the following example, I am providing a list inline with two variables and –basic input to bruteforce a website httpwatch.com wfuzz -z list,nonvalid-httpwatch --basic FUZZ:FUZZ https://www.httpwatch.com/httpgallery/authentication/authenticatedimage/default.aspx

The same can also be achieved with SOCKS proxy like so: wfuzz -z file,wordlist/general/common.txt -p localhost:9500:SOCKS5 http://testphp.vulnweb.com/FUZZ

Fuzzing through Proxy Wfuzz can also route the requests through a proxy. In the following example, a Burp proxy is active on port 8080 and the request intercepted in the burp intercept as you can see. wfuzz -z file,wordlist/general/common.txt -p localhost:8080 http://testphp.vulnweb.com/FUZZ

As you could see, three valid options returned a 200 response code. The same can be input inline using the “list” payload like so: wfuzz -z list,GET-HEAD-POST-TRACE-OPTIONS -X FUZZ http://testphp.vulnweb.com/

HTTP OPTIONS fuzzing There are various HTTP Request/Options methods available that can be specified by using the “-X” flag. In the following example, We have inserted the following options in a text file called options.txt GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH wfuzz -c -w options.txt --sc 200 -X FUZZ “http://testphp.vulnweb.com”

Header fuzzing HTTP header can be added in a request being sent out by wfuzz. HTTP headers can change the behaviour of an entire web page. Custom headers can be fuzzed or injected in an outgoing request Scenarios useful: HTTP Header Injections SQL Injections Host Header Injections wfuzz -z file,wordlist/general/common.txt -H "X-Forwarded-By: 127.0.0.1" -H "User-Agent: Firefox" http://testphp.vulnweb.com/FUZZ

In the above scenario, we have added 2 static cookies on multiple directories. Now, we can also fuzz the cookie parameter too like so: wfuzz -z file,wordlist/general/common.txt -b cookie=FUZZ http://testphp.vulnweb.com/

Cookie fuzzing To send a custom cookie along a request to different fuzzed directories we can use the “-b” plug. This would add a cookie to the sent HTTP request. Scenario useful: Cookie poisoning Session hijacking Privilege Escalation wfuzz -z file,wordlist/general/common.txt -b cookie=secureadmin -b cookie2=value2 --hc 404 http://testphp.vulnweb.com/FUZZ

As you can see, the correct credentials “test-test” have been found. We used a common file for both username and password. The same can be done by providing different files for both usernames and passwords like so: -c is to color code the output response which can be skipped. wfuzz -z file,users.txt -z file,pass.txt --sc 200 -d "uname=FUZZ&pass=FUZ2Z" http://testphp.vulnweb.com/userinfo.php

The same can be implemented using wfuzz like so: -d argument specifies the post data to be sent along with the request wfuzz -z file,wordlist/others/common_pass.txt -d "uname=FUZZ&pass=FUZZ" --hc 302 http://testphp.vulnweb.com/userinfo.php

Login bruteforce HTTP responses can be brute-forced using wfuzz. For example, testphp’s website makes a POST request to the backend and passes “uname” and “pass” as the arguments to a page userinfo.php