fuff对参数进行fuzz

基础get请求，post请求，put请求

ffuf -w g0ld3n-ok.txt -u <http://victim/FUZZ> -X GET

ffuf -w g0ld3n-ok.txt -u <http://victim/FUZZ> -X POST
ffuf -w passwordlist.txt -X POST -d "username=admin\&password=FUZZ" -u <https://www.example.com/login>

ffuf -w g0ld3n-ok.txt -u <http://victim/FUZZ> -X PUT

跟踪重定向

ffuf -w g0ld3n-ok.txt -u <http://victim/FUZZ> -X GET -r -t 10

捕获所有http状态并过滤掉不需要的内容

ffuf -w g0ld3n-ok.txt -u <http://victim/FUZZ> -X GET -r -e ".php,.asp,.xml,.txt,.sh,.js,.aspx,.py" -mc all --fc=404

有时候子域本身也属于目录

ffuf -w g0ld3n-ok.txt -u <http://subdomain.victim/subdomain/FUZZ> -X GET -r -e ".php,.asp,.xml,.txt,.sh,.js,.aspx,.py"
ffuf -w g0ld3n-ok.txt -u <http://subdomain.victim/subdomain/FUZZ> -X POST -r -e ".php,.asp,.xml,.txt,.sh,.js,.aspx,.py"

对参数值进行测试

ffuf -u <https://www.example.com?param=FUZZ> -w wordlist.txt
ffuf -u <https://www.example.com?W1=W2> -w FUZZ1.txt:W1,FUZZ2.txt:W2

cookie认证fuzz

ffuf -u <https://www.example.com/FUZZ> -w wordlist.txt -b "cookies=xxxx"

cors、ssrf测试

ffuf -u <https://www.example.com/FUZZ> -H "-w wordlist.txt -H "主机：FUZZ"

http请求方法fuzz

http请求参数fuzz

对http请求中的所有参数进行fuzz，如：

username=admin&loginID=132&memberID，拆分参数分别为：username，loginID，memberID。