My Notes Hub
  • 📍Introduction Page
  • ⭐Learning Process
    • 🧠Learning Mindset
    • 🖇️Learning Dependencies
    • 🧮Learning Process
  • 🔠Fundamentals
    • 🛜Networking Fundamentals
    • 🐧Linux Fundamentals
      • Introduction
    • 🪟Windows Fundamentals
    • 🕵️Active Directory
    • 🕸️Introduction to Web Applications
  • 🧰Tools
    • Nmap
    • Nessus
    • Ffuf
    • Hydra
    • John The Ripper
  • ✍️Write Ups
    • 🗃️Hack The Box Machines
      • Irked
      • Nibbles
      • Brainfuck
      • Lame (Check)
  • 📋Cheat Sheets
    • Penetration Testing Cheat Sheet
  • 🪪Certificates
    • Penetration Tester (HTB CPTS)
      • Penetration Testing Process
      • Reconnaissance, Enumeration & Attack Planning
        • Network Enumeration with Nmap (Continue Here)
        • Footprinting (Just Do Formatting)
        • Vulnerability Scanning (Check)
        • File Transfers (Continue Here)
        • Using the Metasploit Framework
        • Web Information Gathering
      • Exploitation & Lateral Movement
        • Attacking Common Services (Just Do Formatting)
      • Web Exploitation
        • Using Web Proxies (Check)
        • Attacking Web Applications With Ffuf (Check)
        • Login Bruteforcing
        • Cross-Site Scripting (XSS)
        • Command Injection
        • SQL Injection
        • File Upload Attacks
        • File Inclusion
        • Web Attacks (Check)
      • Post-Exploitation
        • Linux Privilege Escalation
  • 🗄️Archive/Backup/Bin
    • Sysmon Usecases (IBM)
    • 🐧Linux Fundamentals (TryHackMe)
      • Introduction
      • Basic Commands
      • Wildcards & Operators
      • Permissions
      • Common Directories
      • Terminal Text Editors
      • General/Useful Utilities
    • 🪟Windows Fundamentals (TryHackMe)
      • Introduction
      • The File System
      • User Accounts
      • Settings & Control Panel & Task Manager
      • System Configuration
    • Active Directory (TryHackMe)
      • Breaching Active Directory
    • FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
      • Book 2 - Intrusion Analysis
        • Credential Theft
        • Event Log Analysis for Responders and Hunters
    • Certified Threat Hunting Professional (eCTHPv2)
      • Threat Hunting: Hunting the Endpoint & Endpoint Analysis
        • Event IDs, Logging, & SIEMs
    • OSCP
      • Report Writing
      • ✅Passive Information Gathering
      • ✅Active Information Gathering
      • ✅Vulnerability Scanning
      • Introduction to Web Application Attacks
      • Common Web Application Attacks
        • ✅Cross-Site Scripting (XSS)
        • ✅Directory Traversal
        • ✅File Inclusion
        • ✅File Upload Vulnerabilities
        • Command Injection
        • SQL Injection Attacks
        • Client Side Attacks
      • ✅Locating Public Exploits
      • ✅Exploiting Walkthrough
      • Fixing Exploits
      • ✅Antivirus Evasion
      • Password Attacks
      • Windows Privilege Escalation
      • Linux Privilege Escalation
      • Port Redirection and SSH Tunneling
      • Tunneling Through Deep Packet Inspection
      • The Metasploit Framework
      • Active Directory Introduction & Enumeration
      • Attacking Active Directory Authentication
      • Lateral Movement in Active Directory
      • Assembling the Pieces
      • Other General Information
    • ⚡Port Swigger (Web Penetration Testing)
      • ✅Information Disclosure
      • ✅Path Traversal (Directory Traversal)
      • ✅OS Command Injection
      • Business Logic Vulnerabilities
      • ✅Authentication
      • ✅Access Control
    • Certified Bug Bounty Hunter (CBBH)
      • Web Requests
        • HTTP Fundamentals
    • Getting Started
      • Introduction
      • Pentesting Basics
    • Certified Penetration Testing Specialist (CPTS)
      • Introduction
        • ✅Penetration Testing Process
          • Penetration Testing Overview
          • Laws & Regulations
          • Penetration Testing Process
          • Pre-Engagement
          • Information Gathering
          • Vulnerability Assessment
          • Exploitation
          • Post-Exploitation
          • Lateral Movement
          • Proof-of-Concept
          • Post-Engagement
          • Practice
          • Academy Module Layout
        • Getting Started with Hack The Box (HTB)
      • Reconnaissance, Enumeration & Attack Planning
        • ✅Network Enumeration with Nmap
          • Enumeration & Introduction to Nmap
          • Host Discovery
          • Host and Port Scanning
          • Saving The Results
          • Service Enumeration
          • Nmap Scripting Engine
          • Scanning Performance
          • Firewall and IDS/IPS Evasion
        • Footprinting
        • ✅Information Gathering - Web Edition
          • Introduction
          • Passive Information Gathering
          • Active Information Gathering
        • Vulnerability Assessment
        • File Transfers
        • Shells & Payloads
        • Using the Metasploit Framework
      • Exploitation & Lateral Movement
        • Password Attacks
        • Attacking Common Services
        • Pivoting, Tunneling, and Port Forwarding
        • Active Directory Enumeration & Attacks
      • Web Exploitation
        • Using Web Proxies
        • ✅Attacking Web Applications with Ffuf
        • ✅Login Brute Forcing
        • SQL Injection Fundamentals
        • SQLMap Essentials
        • Cross-Site Scripting (XSS)
        • File Inclusion
        • File Upload Attacks
        • Command Injections
        • Web Attacks
        • Attacking Common Applications
      • Post-Exploitation
        • Linux Privilege Escalation
        • Windows Privilege Escalation
      • Reporting & Capstone
        • Documentation & Reporting
        • Attacking Enterprise Networks
Powered by GitBook
On this page
  1. Certificates
  2. Penetration Tester (HTB CPTS)
  3. Web Exploitation

Attacking Web Applications With Ffuf (Check)

Can remove to tools.

  • Ffuf is a reliable tool for web applications fuzzing.

  • Some things you might want to fuzz.

    • Directories

    • Pages

    • Sub-domains

    • Parameters

    • Values

  • To get rid of the credits that are in the secLists wordlists you can use the -ic flag.

  • Ffuf has the option to scan recursively (-recursion), meaning that it automatically starts another scan under any newly identified directories that may have on their pages until it has fuzzed the main website and all of its subdirectories. Since it would take a lot of time, it's recommended to set a depth limit (-recursion-depth).

  • Take note that if the website isn't publicly hosted then you need to add it to your hosts file (Both main site and other discovered subdomains) (Code provided below)

  • Also take note of VHosts which can affect your subdomain fuzzing result. VHost is basically a sub-domain served on the same server and has the same IP.

  • Code:

#Example Fuzzing Directories
ffuf -w <Word-List>:FUZZ -u http://<Server-IP>:<Port-Number>/FUZZ

#Example Extension Fuzzing
ffuf -w <Word-List>:FUZZ -u http://<Server-IP>:<Port-Number>/index.FUZZ

#Example Fuzzing Pages
ffuf -w <Word-List>:FUZZ -u http://<Server-IP>:<Port-Number>/FUZZ.

#Example Recursive (-v to output full URLs.) (-e to set the extension)
ffuf -w <Word-List>:FUZZ -u http://<Server-IP>:<Port-Number>/FUZZ -recursion -recursion-depth  -e  -v

#Example Fuzzing Subdomains
ffuf -w <Word-List>:FUZZ -u http://FUZZ.<Server-IP>:<Port-Number>/

#Fuzzing VHosts, this will generate 200 for all the requests so you need to filter the results by identifying first the unique value of the incorrect result to filter on it. 
ffuf -w <Word-List>:FUZZ -u http://<Server-IP>:<Port-Number>/ -H 'Host: FUZZ.<Server-IP>:<Port-Number> -fs '

#Example Fuzzing Parameters for type GET. Same with the VHosts you will get many false negatives so make sure to filter after identifying the incorrect result to filter on. 

ffuf -w <Word-List>:FUZZ -u http://FUZZ.<Server-IP>:<Port-Number><Endpoint>?FUZZ= -fs <Size-To-Filter>

#Example Fuzzing Parameters for type POST.
ffuf -w <Word-List>:FUZZ -u http://FUZZ.<Server-IP>:<Port-Number><Endpoint> -X POST -d 'FUZZ=<Value>' -H 'Content-Type: application/x-www-form-urlencoded' -fs <Size-To-Filter>

#Code to add entities to the hosts file.
sudo sh -c 'echo "<Server-IP> <URL>" >> /etc/hosts'
PreviousUsing Web Proxies (Check)NextLogin Bruteforcing

Last updated 8 hours ago

🪪