The term fuzzing refers to a testing technique that sends various types of user input to a certain interface to study how it would react. If we were fuzzing for SQL injection vulnerabilities, we would be sending random special characters and seeing how the server would react. If we were fuzzing for a buffer overflow, we would be sending long strings and incrementing their length to see if and when the binary would break.
/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
(Fuzz faster u fool) , it is a tool used for web enumeration, fuzzing and directory brute forcing.
-apt install ffuf
-apt install seclists
1)Basics
$ ffuf -h
$ ffuf -u http://webpage.com/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt
$ ffuf -u http://webpage.com/TARA -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt:TARA
2)Fuzzing Pages and Directories
Files Fuzzing
$ ffuf -u http://webpage.com/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txtHowevery, using a large generic wordlist containing irrelevant file extensions is not very efficient.Instead,we can usually assume index. is the default page on most websites so we can try common extensions for just the index page.
Extension fuzzing
$ ffuf -u http://webpage.com/indexFUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/web-extensions.txt
Page Fuzzing
$ ffuf -w wordlist.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php
$ ffuf -u http://webpage.com/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt
Recursive Fuzzing
$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v
Directories
$ ffuf -u http://webpage.com/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
3)Using filters
-mc : to specify Status code.
-ml: to specify amount of lines in response
-mr: to specify regex pattern
-ms: to specify response size
-mw: to specify amount of words in response
-fw : to filter by the amount of words
-fl : to filter by the number of lines
-fs : to filter by the size of the response
-fc : to filter by the status code
-fr : to filter by the regex pattern
Örneğin 403 status codu'unu geri döndermesin.
$ ffuf -u http://webpage.com/FUZZ -u /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-file-lowercase.txt -fc 403
Something we might want to filter out multiple status codes such as 500,302,401,301 etc. Ex; If you want to see 200 status code responses, you could use -mc 200 (match code) instead of having a long list of filtered codes.
$ ffuf -u http://webpage.com/FUZZ -u /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -mc 200 (match http status codes, or “all” for everyting -mc all) Örneğin dönen 200 status codelarında website size=0 olanlar var bunları filtereleylim; size:0 olanları gösterme
$ ffuf -u http://wepage.com/FUZZ -u /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -mc 200 -fs 0
4)FUZZING Parameters
Parameter Fuzzing - POST
$ ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://dotnetguard.blog:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
Value Fuzzing
$ ffuf -w ids.txt:FUZZ -u http://dotnetguard.blog:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
When you find a page or API endpoint but don't know which parameters are accepted ? ex:
http://webpage.com/sql/Less-1/?-> hangi parametre ismini kullanıyor?
Discovering a vulnerable parameter could lead to file inclusion, path disclosure, XSS,SQLi , or even command injection.
$ ffuf -u http://webpage.com/sql/Less-1/?FUZZ=1 -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 39 (dönen wordliste 39 olanı sil.)At this point, we could generate a wordlist and save a file containing integers.To cut out a step we can use “-w -” which tells ffuf to read a wordlist from stdout.This will allow us to generate a list of integers with a command of our choice then pipe the output to ffuf.
$ for i in {0...255}; do echo $i; done| ffuf -u http://webpage.com/sql/Less-1/id=FUZZ -c -w - -fw 33
We can also use ffuf for wordlist-based brute force attacks, for ex; trying passwords on an authentication page.
$ ffuf -u http://FUZZ.mydomain.com/sql/Labs-11/ -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/Passwords/Leaked-Databases/hak5.xt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=submit' -fs 1345 -H 'Content-Type: application/x-www-form-urlencoded'
5)Finding VHosts and Subdomains
Ffuf may not be as efficient as specialized tools when it comes to subdomain enumeration but it's possible to do.
Vhosts vs. Sub-domains
The key difference between VHosts and sub-domains is that a VHost is basically a 'sub-domain' served on the same server and has the same IP, such that a single IP could be serving two or more different websites.
VHosts may or may not have public DNS records.
Subdomain fuzzing
$ ffuf -u http://FUZZ.mydomain.com -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
VHost Fuzzing
$ ffuf -u http://mydomain.com -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H 'Host: FUZZ.mydomain.com'
6)Proxying ffuf traffic
Whther it for network pivoting or for using BurpSuite plugins we can send all the ffuf traffic through a web proxy (HTTP or SOCKS5)
$ ffuf -u http://<ip>/FUZZ -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -X http://127.0.0.1:8080
It's also possible to send only matches to your proxy for replaying:
$ ffuf -u http://<ip>/FUZZ -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -replay-proxy http://127.0.0.1:8080
Note: Örneğin bir wordlist verdiğimizde içerisinde bulunan yorum satırlarını da göstermesini istemiyorsak ; -ic kullanılır.
Örnekler :
$ ffuf -w /path/to/wordlist -u https://target/FUZZ -recursion -recursion-depth 1
$ ffuf -u http://10.10.112.255/customers/signup -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=FUZZ&email=admin&password=admin&cpassword=admin' -w /usr/share/wordlists/seclists/Usernames/Names/names.txt -mr "username already exists"
$ ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.112.255/customers/login -fc 200
Crawling için;
$ ffuf -w ./vhosts -u http://192.168.10.10 -H "HOST: FUZZ.randomtarget.com" -fs 612