Attacking Web Applications with FFUZ
Basic Fuzzing
Directory Fuzzing
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ
ffuf -w <SNIP> -u http://SERVER_IP:PORT/FUZZ
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZPreguntas
In addition to the directory we found above, there is another directory that can be found. What is it?
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http://94.237.57.115:57907/FUZZ -ac
Page Fuzzing
Extension Fuzzing
Page Fuzzing
Preguntas
Try to use what you learned in this section to fuzz the '/blog' directory and find all pages. One of them should contain a flag. What is the flag?
Vemos las extensiones de los archivos.
Vemos con el nombre de los archivos.
Recursive Fuzzing
Preguntas
Try to repeat what you learned so far to find more files/directories. One of them should give you a flag. What is the content of the flag?
Domain Fuzzing
Sub-domain Fuzzing
Preguntas
Try running a sub-domain fuzzing test on 'inlanefreight.com' to find a customer sub-domain portal. What is the full domain of it?
customer.inlanefreight.com
Vhost Fuzzing
Filtering Results
Preguntas
Try running a VHost fuzzing scan on 'academy.htb', and see what other VHosts you get. What other VHosts did you get?
test.academy.htb
Parameter Fuzzing
Parameter Fuzzing - GET
Preguntas
Using what you learned in this section, run a parameter fuzzing scan on this page. What is the parameter accepted by this webpage?
Parameter Fuzzing - POST
Value Fuzzing
Preguntas
Try to create the 'ids.txt' wordlist, identify the accepted value with a fuzzing scan, and then use it in a 'POST' request with 'curl' to collect the flag. What is the content of the flag?
Vemos el contenido.
Skills Assessment
Preguntas
Run a sub-domain/vhost fuzzing scan on '*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name)
Before you run your page fuzzing scan, you should first run an extension fuzzing scan. What are the different extensions accepted by the domains?
Escaneamos las extensiones de los 3 subdominios.
One of the pages you will identify should say 'You don't have access!'. What is the full page URL?
Vemos todo hasta encontrar ese mensaje.
In the page from the previous question, you should be able to find multiple parameters that are accepted by the page. What are they?
Try fuzzing the parameters you identified for working values. One of them should return a flag. What is the content of the flag?
Escaneamos para ver los usuarios.
Vemos el contenido con ese usuario.
Last updated
Was this helpful?