> For the complete documentation index, see [llms.txt](https://beafn28.gitbook.io/beafn28/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://beafn28.gitbook.io/beafn28/apuntes-hacking/attacking-web-applications-with-ffuz.md).

# Attacking Web Applications with FFUZ

{% file src="/files/x9U4EfkUOV0JWf8XiChi" %}

## Basic Fuzzing

### Directory Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ
ffuf -w <SNIP> -u http://SERVER_IP:PORT/FUZZ
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ
```

#### Preguntas

**In addition to the directory we found above, there is another directory that can be found. What is it?**

```
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http://94.237.57.115:57907/FUZZ -ac
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FBQp7vIcosHMmFKfzFMWv%2Fimage.png?alt=media&amp;token=841d2399-afb2-49d0-b898-eabfe3254444" alt=""><figcaption></figcaption></figure>

### Page Fuzzing

#### Extension Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ <SNIP>
ffuf -w /opt/useful/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://SERVER_IP:PORT/blog/indexFUZZ
```

#### Page Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php
```

#### Preguntas

**Try to use what you learned in this section to fuzz the '/blog' directory and find all pages. One of them should contain a flag. What is the flag?**

Vemos las extensiones de los archivos.

```
 ffuf -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://94.237.57.115:57907/blog/indexFUZZ
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2Fs5ZuC8aM4GCGBAWk7sri%2Fimage.png?alt=media&amp;token=636d63b3-ab92-44d5-9dcd-b9cc10a2b9a6" alt=""><figcaption></figcaption></figure>

Vemos con el nombre de los archivos.

```
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://94.237.57.115:57907/blog/FUZZ.php -ac -ic
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2Fz4EwwwhWj6LEVotVIck2%2Fimage.png?alt=media&amp;token=b58aec73-6991-4657-bf27-ffcc6209d8e7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FBf63fZptNIwb2p6BYXEv%2Fimage.png?alt=media&amp;token=a17ee03d-49a8-4cc4-9625-017bc965ba05" alt=""><figcaption></figcaption></figure>

## Recursive Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v
```

#### Preguntas

**Try to repeat what you learned so far to find more files/directories. One of them should give you a flag. What is the content of the flag?**

```
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ \
     -u http://94.237.57.115:57907/FUZZ \
     -recursion -recursion-depth 1 \
     -e .php \
     -ic -ac -v
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FZbR2gTyvm1cOiViuj6dJ%2Fimage.png?alt=media&amp;token=65649295-2955-4962-9f86-a5559161bee6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FUMEHJinc8dCsz48g45n3%2Fimage.png?alt=media&amp;token=df5e3fd6-4276-44fe-a447-a06e7ccaaabd" alt=""><figcaption></figcaption></figure>

## Domain Fuzzing

### Sub-domain Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://FUZZ.academy.htb/
```

#### Preguntas

**Try running a sub-domain fuzzing test on 'inlanefreight.com' to find a customer sub-domain portal. What is the full domain of it?**

```
 ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ \
     -u http://inlanefreight.com/ \
     -H "Host: FUZZ.inlanefreight.com" -ac -ic -r | grep -i customer
```

customer.inlanefreight.com

### Vhost Fuzzing

```
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'
```

### Filtering Results

```
ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' -fs 900
```

#### Preguntas

**Try running a VHost fuzzing scan on 'academy.htb', and see what other VHosts you get. What other VHosts did you get?**

```
 ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ \
     -u http://94.237.57.115:57907/ \
     -H "Host: FUZZ.academy.htb" \
     -fs 986
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2Fjx7D8hoSyGNAUs713tfH%2Fimage.png?alt=media&amp;token=b99cfe9d-0667-47d5-8127-ae7887bfdcbc" alt=""><figcaption></figcaption></figure>

test.academy.htb

## **Parameter Fuzzing**

### Parameter Fuzzing - GET

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs xxx
```

#### Preguntas

**Using what you learned in this section, run a parameter fuzzing scan on this page. What is the parameter accepted by this webpage?**

```
 ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ      -u http://94.237.57.115:35006/admin/admin.php?FUZZ=random      -H "Host: admin.academy.htb" -fs 798
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FfrwW5dJPwSZmEXYbrSXp%2Fimage.png?alt=media&amp;token=1eb111b1-d89e-4b98-80f1-7ffdb592b9ae" alt=""><figcaption></figcaption></figure>

### Parameter Fuzzing - POST

```
ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
curl http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=key' -H 'Content-Type: application/x-www-form-urlencoded'
```

## Value Fuzzing

```
for i in $(seq 1 1000); do echo $i >> ids.txt; done
```

```
ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs xxx
```

#### Preguntas

**Try to create the 'ids.txt' wordlist, identify the accepted value with a fuzzing scan, and then use it in a 'POST' request with 'curl' to collect the flag. What is the content of the flag?**

```
for i in $(seq 1 1000); do echo $i >> ids.txt; done
ffuf -w ids.txt:FUZZ      -u http://94.237.57.115:35006/admin/admin.php      -X POST -d 'id=FUZZ'      -H "Host: admin.academy.htb"      -H 'Content-Type: application/x-www-form-urlencoded'      -fs 768
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FrhuPzR2k8fuVNmPpYUKj%2Fimage.png?alt=media&amp;token=f9a4d9b4-6654-4b3d-9786-51aea8e2ff0f" alt=""><figcaption></figcaption></figure>

Vemos el contenido.

```
curl -s -X POST      -H "Host: admin.academy.htb"      -d "id=73"      http://94.237.57.115:35006/admin/admin.php
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FaibAN8dK8IZaVR7FMqDP%2Fimage.png?alt=media&amp;token=582e687a-f13a-471c-a535-003d1b9225fc" alt=""><figcaption></figcaption></figure>

## Skills Assessment

#### Preguntas

**Run a sub-domain/vhost fuzzing scan on '\*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name)**

```
 ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ \
     -u http://94.237.61.242:35855/ \
     -H "Host: FUZZ.academy.htb" \
     -mc 200,301,302,403 \
     -ac -ic -r
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F7xVNMHcgplp8ghFAzgT2%2Fimage.png?alt=media&amp;token=7c81a52b-013c-4841-8e64-195e3615c2d1" alt=""><figcaption></figcaption></figure>

**Before you run your page fuzzing scan, you should first run an extension fuzzing scan. What are the different extensions accepted by the domains?**

```
echo "94.237.61.242 archive.academy.htb" | sudo tee -a /etc/hosts
echo "94.237.61.242 test.academy.htb"    | sudo tee -a /etc/hosts
echo "94.237.61.242 faculty.academy.htb" | sudo tee -a /etc/hosts
echo "94.237.61.242 admin.academy.htb" | sudo tee -a /etc/hosts
```

Escaneamos las extensiones de los 3 subdominios.

```
WORDLIST="/usr/share/seclists/Discovery/Web-Content/web-extensions.txt"
ffuf -w "$WORDLIST":FUZZ -u http://archive.academy.htb:35855/indexFUZZ -ic -ac -mc 200,403
ffuf -w "$WORDLIST":FUZZ -u http://test.academy.htb:35855/indexFUZZ    -ic -ac -mc 200,403
ffuf -w "$WORDLIST":FUZZ -u http://faculty.academy.htb:35855/indexFUZZ -ic -ac -mc 200,403
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F0TsN3EtfickQkFGuY0GI%2Fimage.png?alt=media&amp;token=2d6327ba-0f29-4f02-b3da-ef95cde86b14" alt=""><figcaption></figcaption></figure>

**One of the pages you will identify should say 'You don't have access!'. What is the full page URL?**

```
EXTS=.php,.phps,.php7
WL=/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt

for sub in archive test faculty; do
  echo "== $sub ==";
  ffuf -w "$WL":FUZZ \
       -u http://$sub.academy.htb:35855/FUZZ \
       -e $EXTS -ic -ac -r -mc 200,403 \
       -recursion -recursion-depth 1 \
       -mr "You don't have access!"
done
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F92OXCSkjj8pvQTK1IxLK%2Fimage.png?alt=media&amp;token=ea9633a6-40c7-42a0-8dac-0bf5eb1d5072" alt=""><figcaption></figcaption></figure>

Vemos todo hasta encontrar ese mensaje.

```
curl http://faculty.academy.htb:35855/courses/linux-security.php7
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FI4Wxa1HtqsoUHLwZKbd8%2Fimage.png?alt=media&amp;token=28171bb7-e18f-4e13-814a-f932502f5f08" alt=""><figcaption></figcaption></figure>

**In the page from the previous question, you should be able to find multiple parameters that are accepted by the page. What are they?**

```
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://94.237.61.242:35855/courses/linux-security.php7 -X POST -H "Host: faculty.academy.htb" -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs 774
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FpYGLUAH9zlreuCPpoZjr%2Fimage.png?alt=media&amp;token=f13e4726-37ee-4eaa-9705-02dd016c5616" alt=""><figcaption></figcaption></figure>

**Try fuzzing the parameters you identified for working values. One of them should return a flag. What is the content of the flag?**

Escaneamos para ver los usuarios.

```
ffuf -w /usr/share/seclists/Usernames/Names/names.txt:FUZZ -u http://94.237.61.242:35855/courses/linux-security.php7 -X POST -H "Host: faculty.academy.htb" -d 'username=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -fs 781
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FQ4WvGKRefSmCRFC4GMkG%2Fimage.png?alt=media&amp;token=49c5c857-7a8a-49a8-93ae-1cc98473bdbb" alt=""><figcaption></figcaption></figure>

Vemos el contenido con ese usuario.

```
curl http://94.237.61.242:35855/courses/linux-security.php7 -X POST -H "Host: faculty.academy.htb" -d 'username=harry' -H 'Content-Type: application/x-www-form-urlencoded'
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FhzyLKhH4ab0yHTl13D4r%2Fimage.png?alt=media&amp;token=3e2cbd63-3b1a-4b44-ade5-9d2b3e0dee47" alt=""><figcaption></figcaption></figure>