Web Fuzzing & Attacking Web Applications with Ffuf

Directory Fuzzing

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ

Extension fuzzing

ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://SERVER_IP:PORT/blog/indexFUZZ

Page fuzzing

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php

Recursive scanning

ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v

DNS

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/

VHost

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'

Parameter & Value fuzzing

GET

ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:30239/admin/admin.php?FUZZ=key -fs xxx

POST

Tip: In PHP, “POST” data “content-type” can only accept “application/x-www-form-urlencoded”. So, we can set that in “ffuf” with “-H ‘Content-Type: application/x-www-form-urlencoded’”.

ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx

untuk

curl http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'

ffuf -w /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -X POST -u https://69ef56304f6822c821986b332fe7c1ae.ctf.hacker101.com/login -d 'username=FUZZ\&password=pass' -fs 329

ffuf with hashed value of wordlist

ffuf -w <(cat /usr/share/seclists/Usernames/top-usernames-shortlist.txt | while read line; do echo -n "$line" | md5sum | cut -d' ' -f1; done) -u http://94.237.57.1:54814/skills/ -H "Cookie: cookie=FUZZ"

Value Fuzzing

easiest to type id

for i in $(seq 1 1000); do echo $i >> ids.txt; done

vhost

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'

Fuzz value using wenum

Setup

pipx install git+https://github.com/WebFuzzForge/wenum
pipx runpip wenum install setuptools

wenum -w /usr/share/seclists/Discovery/Web-Content/common.txt --hc 404 -u "http://IP:PORT/get.php?x=FUZZ"

ffuf -u http://IP:PORT/post.php -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "y=FUZZ" -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200 -v

Vhost and subdomain fuzzing

gobuster

gobuster dns -domain inlanefreight.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Filtering fuzzing output

-fc Filter HTTP status codes from response. Comma separated list of codes and ranges -fl Filter by amount of lines in response. Comma separated list of line counts and ranges -fr Filter regexp -fs Filter HTTP response size. Comma separated list of sizes and ranges -fw Filter by amount of words in response. Comma separated list of word counts and ranges

HTB Academy - Web Fuzzing & Attacking Web Applications with Ffuf