Basic Usage

Note: If you installed the app via pip, just replace the ./FuzzingTool.py to FuzzingTool

Base results format

The base result for all the scanners include this format (at least):

{ requestIndex, requestMethod, payload, RTT, requestElapsedTime, responseElapsedTime, responseStatus, responseLength, responseQuantityOfWords, responseQuantityOfLines }

Matching results

Every scanner does a match analysis on FuzzingTool result before any other specific scan. You can match results based on response: status code -Mc, length -Ms and elapsed time -Mt.

Match by status code: Set a single, a list, or a range of status code to match.

-Mc 500 # Set only status code 500
-Mc 200,301,302 # Set a list of status codes; including 200, 301 and 302
-Mc 500-600 # Set a range of status codes; 500 <= status <= 600
-Mc 200,301,302,500-600 # Combination of the previous examples

Match by length: Set a length to match (in bytes)

-Ms 1000 # Set the response size to match greater than 1000 bytes

Match by elapsed time: Set a time (RTT) to match (in seconds)

-Mt 30 # Set the request+response elapsed time to match greater than 30 seconds

Combine match options to perform a precise analysis.

$ ./FuzzingTool.py -u https://mydomainexample.com/post.php?id= -w ~/wordlists/sqli.txt -Mc 500 -Mt 20 -t 50

Blacklisting status codes

With setting a status code to blacklist, you avoid the FuzzingTool to keep doing fuzzing tests when a unwanted status is detected.

--blacklist-status STATUS:ACTION
# Available actions: skip | wait
--blacklist-status STATUS:skip # Skips the current target
--blacklist-status STATUS:wait=SECONDS # Pause the app for some seconds

For example, if you don't want to stress the server or cause internal errors, just skip the current target when detecting code 500:

--blacklist-status 500:skip

Another example, if the server rejects your requests (status 429) you can pause the app for some seconds:

--blacklist-status 429:wait=300 # Will wait for 5 minutes before resume the app

Default scanners

DataScanner

The DataScanner is the default scanner for DataFuzzing type of fuzzing. This scanner add two new attributes for the result:

FuzzingToolResult += { payloadLength, responseBodyText }

PathScanner

The PathScanner is the default scanner for URL PathFuzzing type of fuzzing. This scanner add one new attribute for the result, and change the payload attribute value to the URL path:

FuzzingToolResult['payload'] = urlPath
FuzzingToolResult += { redirected }

SubdomainScanner

The SubdomainScanner is the default scanner for URL SubdomainFuzzing type of fuzzing. This scanner add one new attribute for the result:

FuzzingToolResult += { targetIp }

Default Dictionaries

FileDictionary

The file dictionary build the wordlist based on a file.

-w ~/example/directory/wordlist.txt

Example:

./FuzzingTool.py -u https://$.domain.com/ -w ~/wordlists/subdomains.csv

ListDictionary

The list dictionary build the wordlist based on a payload list gived in the terminal.

-w [payload1,payload2,...]