Fuzzing is a way of finding bugs using automation. It involves providing a wide range of invalid and unexpected data to an application and then monitoring the application for exceptions. In particular, web application fuzzing is the field of fuzzing web applications to expose common web vulnerabilities, like injection issues, XSS, and more.

模糊测试是一种使用自动化发现错误的方法。 它涉及向应用程序提供各种无效和意外数据，然后监视应用程序的异常。 尤其是，Web应用程序模糊测试是对Web应用程序进行模糊测试以暴露常见的Web漏洞(例如注入问题，XSS等)的领域。

I’ve discussed how fuzzing can help you discover XSS and SQL injections automatically in an earlier article. If you haven’t already, please take a look to understand the basics of fuzzing!

在前面的文章中，我已经讨论了模糊测试如何帮助您自动发现XSS和SQL注入。 如果还没有，请看一看以了解模糊测试的基本知识！

But how do you fuzz a web application effectively? And how can you utilize tools to achieve your goals? Today, we’ll take a practical look at how to fuzz for the most common web vulnerabilities using the open-source tool Wfuzz.

但是，如何有效地模糊Web应用程序呢？ 以及如何利用工具实现目标？ 今天，我们将实际研究如何使用开放源代码工具Wfuzz对最常见的网络漏洞进行模糊处理 。

Wfuzz基础 (Basics of Wfuzz)

Wfuzz is an open-source web application fuzzer. You can install it using the following command:

Wfuzz是一个开放源代码的Web应用程序模糊器。 您可以使用以下命令进行安装：

$ pip install wfuzz

When provided with a wordlist and an endpoint, Wfuzz replaces all the marked locations with strings from the wordlist.

当提供单词列表和端点时，Wfuzz用单词列表中的字符串替换所有标记的位置。

Injection points are marked with the string FUZZ in Wfuzz. For example, this Wfuzz command will replace the FUZZ inside the URL with every string in wordlist.txt:

注射点在Wfuzz中用字符串FUZZ标记。 例如，此Wfuzz命令将用wordlist.txt每个字符串替换URL中的FUZZ ：

$ wfuzz -w wordlist.txt http://example.com/FUZZThese requests will be generated:
http://example.com/authorize.php
http://example.com/cron.php
http://example.com/administrator
http://example.com/secure

Can you think of any scenario where you can apply the functionality of Wfuzz to bug bounties?

您能想到可以将Wfuzz功能应用于漏洞赏金的任何情况吗？

路径枚举 (Path Enumeration)

First, during the recon stage of hunting, you can use Wfuzz to enumerate file paths on a server. Here’s an example command you can use to enumerate file paths:

首先，在搜寻的侦察阶段，您可以使用Wfuzz枚举服务器上的文件路径。 这是一个示例命令，可用于枚举文件路径：

$ wfuzz -w wordlist.txt -f output.txt --hc 404 --follow http://example.com/FUZZ

The -w flag option specifies the wordlist to use for enumeration. In this case, you should pick a good path enumeration wordlist that is designed for the technology used by your target. SecLists has a collection of wordlists you can use:

-w标志选项指定用于枚举的单词表。 在这种情况下，您应该选择一个适合目标使用的技术的路径枚举单词表。 SecLists包含您可以使用的单词表集合：

Another good wordlist database for both enumeration and vulnerability fuzzing is FuzzDB:

另一个用于枚举和漏洞模糊检测的不错的单词表数据库是FuzzDB：

The -f flag specifies the output file location. --hc 404 tells Wfuzz to exclude any response that has a 404 status code. With this filter, we can easily drop URLs that do not point to a valid file or directory from the results list. And the --follow flag tells Wfuzz to follow all HTTP redirections so that our result shows the actual destination of the URL.

-f标志指定输出文件的位置。 --hc 404告诉Wfuzz排除任何具有404状态代码的响应。 使用此过滤器，我们可以轻松地从结果列表中删除未指向有效文件或目录的URL。 --follow标志告诉Wfuzz遵循所有HTTP重定向，以便我们的结果显示URL的实际目的地。

Let’s run the command using a simple wordlist to see what we can find on Facebook. We will be using a wordlist comprised of just four words for testing purposes:

让我们使用一个简单的单词表运行该命令，以查看我们在Facebook上可以找到的内容。 我们将使用仅包含四个单词的单词列表进行测试：

wordlist.txt has four lines:authorize.php
cron.php
administrator
secure

We run this command to enumerate paths on Facebook:

我们运行以下命令来枚举Facebook上的路径：

wfuzz -w wordlist.txt -f output.txt --hc 404 --follow http://facebook.com/FUZZ

Let’s take a look at the results! From left to right, the columns of a Wfuzz report are the “Request ID,” “HTTP Response Code,” “Response Length in Lines,” “Response Length in Words,” “Response Length in Characters,” and the “Payload Used” of the Wfuzz request.

让我们看看结果！ Wfuzz报告的列从左到右分别是“请求ID”，“ HTTP响应代码”，“行中的响应长度”，“字中的响应长度”，“字符中的响应长度”和“使用的有效负载”。 Wfuzz请求的“。

You can see here that the results just showed one line. This is because we used a response code filter to filter out the irrelevant results! Since we dropped all the 404 responses, we can focus on the URLs that pointed to actual paths. And from the results, we can see that /secure is a valid path on Facebook!

您可以在此处看到结果仅显示一行。 这是因为我们使用了响应代码过滤器来过滤掉不相关的结果！ 由于我们删除了所有404响应，因此我们可以专注于指向实际路径的URL。 从结果中，我们可以看到/secure是Facebook上的有效路径！

蛮力认证 (Brute-Forcing Authentication)

After you’ve found some valid file paths on the target, you might find that some of the pages on the server are protected. Most of the time, these pages will have a 403 response code. What can you do then?

在目标上找到一些有效的文件路径后，您可能会发现服务器上的某些页面受到了保护。 大多数情况下，这些页面将具有403响应代码。 那你该怎么办？

You could try to brute-force the authentication on the page! For example, sometimes pages use the basic authentication scheme as access control. In this case, you can get Wfuzz to fuzz the authentication headers by using the -H flag to specify custom headers.

您可以尝试在页面上强制执行身份验证！ 例如，有时页面使用基本身份验证方案作为访问控制。 在这种情况下，可以使Wfuzz通过使用-H标志指定自定义标头来模糊身份验证标头。

$ wfuzz -w wordlist.txt -H "http://example.com/admin

The basic authentication scheme uses credentials that are the base64-encoded strings of username-password pairs. For example, if your username and password were “admin” and “password,” your authentication string would be base64(“admin:password”), which is YWRtaW46cGFzc3dvcmQ=. You could generate authentication keys from common username-password pairs using a script, then feed them to protected pages of the target using Wfuzz.

基本身份验证方案使用凭据，即用户名-密码对的base64编码字符串。 例如，如果您的用户名和密码分别为“ admin”和“ password”，则您的身份验证字符串将为base64(“admin:password”) ，即YWRtaW46cGFzc3dvcmQ= 。 您可以使用脚本从常见的用户名/密码对生成身份验证密钥，然后使用Wfuzz将它们提供给目标的受保护页面。

Another way to brute-force authentication is to use the --basic option of Wfuzz. This option automatically constructs credentials to brute-force basic authentication given an input list of usernames and passwords. In Wfuzz, different injection points are marked with FUZZ, FUZ2Z, FUZ3Z, and so on. They will be fuzzed with the first, second, and third wordlist passed in, respectively. Here’s a command you can use to fuzz the username and password field at the same time:

暴力身份验证的另一种方法是使用--basic选项。 给定用户名和密码的输入列表，此选项将自动构造凭据以强制进行基本身份验证。 在Wfuzz中，不同的注入点标记为FUZZ ， FUZ2Z ， FUZ3Z等。 他们将被分别传入的第一个，第二个和第三个单词表弄糊涂。 您可以使用以下命令同时模糊用户名和密码字段：

$ wfuzz -w usernames.txt -w passwords.txt --basic FUZZ:FUZ2Z http://example.com/admin

usernames.txt contains two usernames: “admin” and “administrator.” And passwords.txt contains three passwords: “secret,” “pass,” and “password.” You can see that Wfuzz will send a request for each username-password combination on your lists.

usernames.txt包含两个用户名：“ admin”和“ administrator”。 passwords.txt包含三个密码：“秘密”，“密码”和“密码”。 您可以看到Wfuzz将针对列表中的每个用户名和密码组合发送一个请求。

Some other ways of bypassing authentication using brute-forcing are to switch out the user-agent or forge custom headers used for authentication. You could accomplish all of these by using Wfuzz to brute-force headers!

使用暴力破解绕过身份验证的其他一些方法是切换用户代理或伪造用于身份验证的自定义标头。 您可以通过使用Wfuzz强制执行标头来完成所有这些工作！

测试常见的Web漏洞 (Testing for Common Web Vulnerabilities)

Finally, Wfuzz can help you test for common web vulnerabilities automatically.

最后，Wfuzz可以帮助您自动测试常见的Web漏洞。

First, you can use Wfuzz to fuzz URL parameters and test for vulnerabilities like IDOR and open redirect. You can fuzz URL parameters by placing a FUZZ keyword in the URL. For example, if a site uses a numeric ID for their chat messages, you can fuzz the ID by using this command:

首先，您可以使用Wfuzz来模糊URL参数并测试IDOR和开放重定向之类的漏洞。 您可以通过在URL中放置FUZZ关键字来模糊URL参数。 例如，如果站点的聊天消息使用数字ID，则可以使用以下命令模糊ID：

$ wfuzz -w wordlist.txt http://example.com/view_message?message_id=FUZZ

Then, find valid IDs by examining the response codes or content length of the response and see if you can access the messages of others.

然后，通过检查响应代码或响应的内容长度找到有效的ID，并查看是否可以访问其他人的消息。

You can also test a redirect parameter with different open redirect payloads:

您还可以使用不同的打开重定向有效负载来测试重定向参数：

$ wfuzz -w wordlist.txt http://example.com?redirect=FUZZ

To check if a payload causes a redirect, you need to turn on the follow ( —- follow) and the verbose (-v) options of Wfuzz. The verbose option will show whether a redirect occurred during the request.

要检查有效载荷是否导致重定向，您需要打开Wfuzz的follow( —- follow )和详细( -v )选项。 verbose选项将显示在请求期间是否发生了重定向。

$ wfuzz -w wordlist.txt -v http://example.com?redirect=FUZZ

For example, in this request, you can see that the payload fb.me causes the request to redirect to facebook.com. See if you can construct a payload that redirects users to your site!

例如，在此请求中，您可以看到有效负载fb.me导致请求重定向到facebook.com。 看看您是否可以构建将用户重定向到您的站点的有效负载！

You can test for vulnerabilities such as XSS and SQL injection by fuzzing HTTP URL parameters or POST parameters with common payload lists. In Wfuzz, POST body data is specified with the -d flag:

您可以使用常见的有效负载列表来对HTTP URL参数或POST参数进行模糊处理，从而测试XSS和SQL注入等漏洞。 在Wfuzz中，POST主体数据通过-d标志指定：

$ wfuzz -w xss.txt http://example.com/get_user?user_id=FUZZ (Tests for reflected XSS.)$ wfuzz -w sqli.txt -d "user_id=FUZZ" http://example.com/get_user (Tests for SQL injection.)

When testing for XSS using Wfuzz, create a list of scripts that redirect the user to your page and turn on the verbose option of Wfuzz to monitor for any redirects. Alternatively, you can use Wfuzz content filters to find XSS payloads reflected on the webpage to see if you succeeded. The --filter flag sets a result filter. An especially useful filter is content~STRING. It returns responses that contain STRING.

使用Wfuzz测试XSS时，创建一个脚本列表，这些脚本会将用户重定向到您的页面，然后打开Wfuzz的详细选项以监视所有重定向。 另外，您可以使用Wfuzz内容过滤器查找反映在网页上的XSS有效载荷，以查看是否成功。 --filter标志设置结果过滤器。 一个特别有用的过滤器是content~STRING 。 它返回包含STRING响应。

$ wfuzz -w xss.txt --filter "content~FUZZ" http://example.com/get_user?user_id=FUZZ

For SQL injection vulnerabilities, you can use a premade SQL injection wordlist and monitor for anomalies in the response time, response code, or response length of each payload.

对于SQL注入漏洞，您可以使用预制SQL注入单词表并监视每个有效负载的响应时间，响应代码或响应长度中的异常。

有关Wfuzz的更多信息 (More About Wfuzz)

There are many more advanced options, filters, and customizations that you can take advantage of with Wfuzz. Used to its full potential, Wfuzz can automate the most tedious parts of your workflow and help you find more bugs. For more cool Wfuzz tricks, read the documentation:

使用Wfuzz可以利用许多其他高级选项，过滤器和自定义项。 Wfuzz发挥了全部潜能，可以自动执行工作流程中最繁琐的部分，并帮助您查找更多错误。 有关更酷的Wfuzz技巧，请阅读文档：

Thanks for reading!

谢谢阅读！