FUZZ测试工具¶
Wfuzz¶
WFuzz是用于Python的Web应用程序安全性模糊工具和库。它基于一个简单的概念：它将给定有效负载的值替换对FUZZ关键字的任何引用。是一款很好的辅助模糊测试工具。它允许在HTTP请求里注入任何输入的值，针对不同的WEB应用组件进行多种复杂的爆破攻击。比如：参数、认证、表单、目录/文件、头部等等。
特性¶
- 递归（目录发掘）
- Post数据爆破
- 头部爆破
- 输出HTML（详细报告，点击链接查看内容，POST数据也能阅览）
- 多彩输出
- 返回码、词数、行数等等来隐藏结果。
- URL编码
- Cookie
- 多线程
- 代理支持
- 多参数fuzz
Filtering options¶
Bash
--hs/ss "regex" #Hide/Show
#Simple example, match a string: "Invalid username"
#Regex example: "Invalid *"
--hc/sc CODE #Hide/Show by code in response
--hl/sl NUM #Hide/Show by number of lines in response
--hw/sw NUM #Hide/Show by number of words in response
--hh/sh NUM #Hide/Show by number of chars in response
--hc/sc NUM #Hide/Show by response code
Output options¶
Bash
wfuzz -e printers #Prints the available output formats
-f /tmp/output,csv #Saves the output in that location in csv format
Encoders options¶
Bash
wfuzz -e encoders #Prints the available encoders
#Examples: urlencode, md5, base64, hexlify, uri_hex, doble urlencode
In order to use an encoder, you have to indicate it in the "-w" or "-z" option.
Examples:
Bash
-z file,/path/to/file,md5 #Will use a list inside the file, and will transform each value into its md5 hash before sending it
-w /path/to/file,base64 #Will use a list, and transform to base64
-z list,each-element-here,hexlify #Inline list and to hex before sending values
CheatSheet¶
Login Form bruteforce¶
POST, Single list, filter string (hide)¶
Bash
wfuzz -c -w users.txt --hs "Login name" -d "name=FUZZ&password=FUZZ&autologin=1&enter=Sign+in" http://zipper.htb/zabbix/index.php
#Here we have filtered by line
POST, 2 lists, filter code (show)¶
Bash
wfuzz.py -c -z file,users.txt -z file,pass.txt --sc 200 -d "name=FUZZ&password=FUZ2Z&autologin=1&enter=Sign+in" http://zipper.htb/zabbix/index.php
#Here we have filtered by code
GET, 2 lists, filter string (show), proxy, cookies¶
Bash
wfuzz -c -w users.txt -w pass.txt --ss "Welcome " -p 127.0.0.1:8080:HTTP -b "PHPSESSIONID=1234567890abcdef;customcookie=hey" "http://example.com/index.php?username=FUZZ&password=FUZ2Z&action=sign+in"
Bruteforce Directory/RESTful bruteforce¶
Path Parameters BF¶
Header Authentication¶
Basic, 2 lists, filter string (show), proxy¶
Bash
wfuzz -c -w users.txt -w pass.txt -p 127.0.0.1:8080:HTTP --ss "Welcome" --basic FUZZ:FUZ2Z "http://example.com/index.php"
NTLM, 2 lists, filter string (show), proxy¶
Bash
wfuzz -c -w users.txt -w pass.txt -p 127.0.0.1:8080:HTTP --ss "Welcome" --ntlm 'domain\FUZZ:FUZ2Z' "http://example.com/index.php"
Cookie/Header bruteforce (vhost brute)¶
Cookie, filter code (show), proxy¶
Bash
wfuzz -c -w users.txt -p 127.0.0.1:8080:HTTP --ss "Welcome " -H "Cookie:id=1312321&user=FUZZ" "http://example.com/index.php"
User-Agent, filter code (hide), proxy¶
Bash
wfuzz -c -w user-agents.txt -p 127.0.0.1:8080:HTTP --ss "Welcome " -H "User-Agent: FUZZ" "http://example.com/index.php"
Host¶
Bash
wfuzz -c -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-
top1million-20000.txt --hc 400,404,403 -H "Host: FUZZ.example.com" -u
http://example.com -t 100
HTTP Verbs (methods) bruteforce¶
Using file¶
Using inline list¶
Directory & Files Bruteforce¶
Bash
#Filter by whitelisting codes
wfuzz -c -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --sc 200,202,204,301,302,307,403 http://example.com/uploads/FUZZ
FFuf¶
常用命令¶
Bash
基础指令
• -u url地址
• -w 设置字典
• -c 将响应状态码用颜色区分，windows下无法实现该效果。
• -t 线程率，默认40
• -p 请求延时： 0.1、0.2s
• -ac 自动校准fuzz结果
• -H Header头，格式为 “Name: Value”
• -X HTTP method to use
• -d POST data
• -r 跟随重定向
• -recursion num 递归扫描
• -x 设置代理 http 或 socks5://127.0.0.1:8080
• -s 不打印附加信息，简洁输出
• -e 设置脚本语言 -e .asp,.php,.html,.txt等
• -o 输出文本
• -of 输出格式文件，支持html、json、md、csv、或者all
基础用法¶
匹配输出¶
ffuf提供了仅获取具有特定特征的状态码、行数、响应大小、字数以及匹配正则表达式的模式进行响应输出。
- ```sh
- -mc ：指定状态代码。
- -ml：指定响应行数
- -mr: 指定正则表达式模式
- -ms：指定响应大小
- -mw：指定响应字数
过滤输出¶
不输出 **200，300**状态码：