From 83708298c8fbdc8e459051c6c972dcff60681f7a Mon Sep 17 00:00:00 2001 From: Fazle Arefin Date: Mon, 1 Apr 2024 18:12:41 +1100 Subject: [PATCH] wfuzz: edit page (#12585) --- pages/common/wfuzz.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/pages/common/wfuzz.md b/pages/common/wfuzz.md index d7071decd..2cb780535 100644 --- a/pages/common/wfuzz.md +++ b/pages/common/wfuzz.md @@ -5,7 +5,7 @@ - Directory and file bruteforce using the specified [w]ordlist and also [p]roxying the traffic: -`wfuzz -w {{path/to/file}} -p {{127.0.0.1:8080}} {{http://example.com/FUZZ}}` +`wfuzz -w {{path/to/file}} -p {{127.0.0.1:8080:HTTP}} {{http://example.com/FUZZ}}` - Save the results to a [f]ile: @@ -22,3 +22,15 @@ - Brute force Basic Authentication using a list of usernames and passwords from files for each FUZ[z] keyword, [h]iding response [c]odes of unsuccessful attempts: `wfuzz -c --hc {{401}} -s {{delay_between_requests_in_seconds}} -z file,{{path/to/usernames}} -z file,{{path/to/passwords}} --basic 'FUZZ:FUZ2Z' {{https://example.com}}` + +- Provide wordlist directly from the command line and use POST request for fuzzing: + +`wfuzz -z list,{{word1-word2-...}} {{https://api.example.com}} -d {{"id=FUZZ&showwallet=true"}}` + +- Provide wordlists from a file applying base64 and md5 encoding on them (`wfuzz -e encoders` lists all available encoders): + +`wfuzz -z file,{{path/to/file}},none-base64-md5 {{https://example.com/FUZZ}}` + +- List available encoders/payloads/iterators/printers/scripts: + +`wfuzz -e {{encoders|payloads|iterators|printers|scripts}}`