📝 Overview
What it is: The process of automating the injection of malformed or unexpected data into a target application to discover vulnerabilities, crashes, or hidden resources. Target Phase: Enumeration / attack Environment: Web Applications, Compiled Binaries, Network Protocols
⚙️ Core Concepts
- Mutation-based (Dumb Fuzzing): Taking a valid input and randomly flipping bits or appending data before sending it.
- Generation-based (Smart Fuzzing): The tool understands the underlying protocol or file format and generates inputs that are almost valid to bypass initial error checking.
- Wordlists: Web fuzzing heavily relies on curated lists (like the SecLists repository) to quickly guess hidden directories or parameters.
💻 Common Commands (ffuf)
| Command | Description |
|---|---|
ffuf -w /path/to/wordlist.txt -u http://target.com/FUZZ | Directory Fuzzing: Replaces the word “FUZZ” with every word in the wordlist to find hidden pages. |
ffuf -w params.txt -u http://target.com/page.php?FUZZ=test | Parameter Fuzzing: Hunting for hidden HTTP parameters. |
🏷️ Tags
Fuzzing Enumeration attack WebSecurity ffuf linux clitool PenTestPlus