hacking: security in practice
i want to prank my friend

hi,i want to prank my friend by making an link and gaining access to his camera.Is that possible?I want to send it through instagram?Thanks a lot

submitted by /u/Lukav1nE
[link] [comments]

Hacking on Medium
Anonymous collective takes down the Federal Security Service of the Russian Federation

https://cdn-images-1.medium.com/max/881/1*PA4sNwE_jL-88sAfRITHZQ.jpeg
#Anonymous collective has taken down the federal security service of the Russian federation site (fsb.ru), earlier today the group stated:

Continue reading on Medium »

Hacking on Medium
The most important thing when using cloud services

https://cdn-images-1.medium.com/max/1272/1*s5p4_mkGHgyDq96NIao5fQ.jpeg
What is cloud space, and how does it work?

Continue reading on Medium »

Hacking on Medium
How to hack someone's password

https://cdn-images-1.medium.com/max/2600/1*i7c7u0sIVdd7a9KrqvLOBg.jpeg
In this blog, we will be looking at how hackers crack passwords and what common techniques they use for this purpose.

Continue reading on Medium »

Hacking on Medium
Pwning binaries and defeating modern mitigations using rop and ret2libc (foobar 2022 pwn writeup)

https://cdn-images-1.medium.com/max/600/1*JxBCboNipG4Z-kia4xJfpA.png
In this article, i’ll explain and teach how to approach these kind of challenges, and how to defeat Stack canaries, ASLR, NX and PIE…

Continue reading on Medium »

Authz0 - An Automated Authorization Test Tool. Unauthorized Access Can Be Identified Based On URLs And RolesAnd Credentials
http://www.kitploit.com/2022/03/authz0-automated-authorization-test.html

🔑 Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. (2)">
Authz0 is an automated (https://www.kitploit.com/search/label/Automated) authorization (https://www.kitploit.com/search/label/Authorization) test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication (https://www.kitploit.com/search/label/Authentication) headers (https://www.kitploit.com/search/label/Headers) and cookies (https://www.kitploit.com/search/label/Cookies) with a template file created/generated once.
🔑 Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. (11)">

 Key Features Generate scan template $ authz0 new Include URLs Include Roles Include ZAP history (Select URLS > Save Selected Entiries as HAR) Include Burp history (Select URLs > Save item) Include HAR file Easy modify scan template (Role, URL) $ authz0 setUrl $ authz0 setRole authz0 setCred Scanning authorization(access-control) with template $ authz0 scan  Installation go install go install github.com/hahwul/authz0@latest
homebrew brew tap hahwul/authz0
brew install authz0
Need more information? please refer to installation guide (https://authz0.hahwul.com/installation.html)  Usage Available Commands: completion Generate the autocompletion script for the specified shell
help Help about any command
new Generate new template
scan Scanning
setCred Append Credential to Template
setRole Append Role to Template
setUrl Append URL to Template
version Show version
1. Generate template authz0 new [flags]
e.g authz0 new target.yaml --include-urls urls.txt
authz0 new target.yaml --include-zap zapurls.har
authz0 new target.yaml --include-burp burpurl.xml
2. Modify template [flags] authz0 setRole [flags] authz0 setUrl [flags]">authz0 setCred [flags]
authz0 setRole [flags]
authz0 setUrl [flags]
e.g authz0 setUrl target.yaml setUrl -u https://www.hahwul.com
authz0 setRole target.yaml -n User1
authz0 setCred target.yaml -n User1 -H "X-API-Key: 1234" -H "TestHeader: 12344"
3. Scanning authz0 scan [flags]
e.g authz0 scan target.yaml
authz0 scan target.yaml -r TestUser1 -H "Cookie: 1234=1234" -H "X-API-Key: 1234555"
 Documents https://authz0.hahwul.com (https://authz0.hahwul.com/) Question Please use discussions (https://github.com/hahwul/authz0/discussions) actively!  Changelog Detailed changes for each release are documented in the release notes (https://github.com/hahwul/authz0/releases). Contributing Authz0's open-source project and made it with if you want contribute this project, please see CONTRIBUTING.md (https://github.com/hahwul/authz0/blob/main/CONTRIBUTING.md) and Pull-Request with cool your contents.

Download Authz0 (https://github.com/hahwul/authz0)

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Wfuzz

IntroductionMany tools have been developed that create an HTTP request and allow a user to modify their contents. Fuzzing works the same way. A user can send a similar request multiple times to the server with a certain section of the request changed. When that certain section is replaced by a variable from a list or directory, it is called fuzzing.<o:p

In this article, we will learn how we can use wfuzz, which states for “Web Application Fuzzer”, which is an interesting open-source web fuzzing tool. Since its release, many people have gravitated towards wfuzz, particularly in the bug bounty scenario. So, let’s dive into this learning process.<o:p Table of content<o:p· Introduction to wfuzz<o:p· Setup<o:p· Wfpayload and Wfencode<o:p· Docker run wfuzz<o:p· Payloads<o:p· Subdomain Fuzzing<o:p· Directory Fuzzing<o:p· Saving fuzzing output<o:p· Basic wordlist filters<o:p· Double fuzzing<o:p· Login bruteforce<o:p· Cookie fuzzing<o:p· Header fuzzing<o:p· HTTP OPTIONS fuzzing<o:p· Fuzzing through Proxy<o:p· Authentication fuzz<o:p· Recursive fuzz<o:p· Printers and output<o:p· Encoders<o:p· Storing and restoring fuzz from recipes<o:p· Ignoring exceptions and errors<o:p· Filtering results<o:p· Sessions in wfuzz<o:p· Conclusion<o:pIntroduction to Wfuzz<o:pWfuzz is a python coded application to fuzz web applications with a plethora of options. It offers various filters that allow one to replace a simple web request with a required word by replacing it with the variable “FUZZ.”<o:p Setup<o:pTo install wfuzz using pip, we can:<o:p pip3 install wfuzz<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiNtimNpNWYyqjsIgyqKdnkiQtBUZZVLFmNVEVTGJUawPDmZo_fTSmHrldgoUaAKsW1TeLQP1BOH2LHk_BfBBoPhU-6BLxuSS7nZP9MFnvV_ZlaCPj7baUxLsxW6bmkhQP6QZKcBhuVn1DRamxenMcgodhavZkkpQYaiqdiptkjomg3CGZ63j6oplFC2Q=s16000 The same could be achieved by installing from the source using git.<o:p git clone https://github.com/xmendez/wfuzz.git<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEibwjNr9tIFE7UnFpttVMQdE8mmHE_4FL-kxIXyy3roCcSDm1Unf9CXqphA6Cjk1XC5rH8Q2-wUspCpDm4NEbXjEdqDKA3XjNGMGUN1Ce3uu4-UOrR3WeBXzwGp8gdtoFve4U5VJV84DmaPA6fFtqzVSrUqeUd_0n3Zp5kg2A96K-mbdkJOB0eGjTi3KA=s16000 The help menu to see all the working options is as follows:<o:p wfuzz -h<o:pwfuzz --help<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhujNJyqVzJJhKvvC0OCowqjlHUIvNRz9BHV-ZrUZ2Eo8WRR70rpxpWrWhyx3UR8awBM-CTgXGLvjRDbrfmfFj2CbzMN5_LuTe_9icB4HJrsfrb5cGgW77A-hwxPVsxxGhNwYrhkAlhPQY8VoNrUfnv7frInrD1vhtozHJo49kWv38D7oIH81VRP6XNcA=s16000 You can use a module by using “-z”<o:p Wfpayload and Wfencode<o:pWhen you install the tool from source, compiled executables called wfpayload and wfencode are available. These are responsible for payload generation and encoding. They can be individually used. For example, command to generate digits from 0 to 15 is as follows:<o:p ./wfpayload -z range,0-15<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhyEj6pgrzNFjgW2gtePPSS31QKt-1nKoWgJILHMC3wrWO47VP50IzNqvmOw7gRG9vq_gz4zlWjsVBdGvCpKy__SOzxGnNXMbe_Mdx34-RWn3tP-EBD99szQJX7S7EQsVzU_fNqAvN8xHgN7K9Kjvw9-ibEVRrIIN8_PehPJ2i_TO0W9sUe85nxa3NVOQ=s16000 As you can see, there is a pycurl error. It can go away like so:<o:p apt --purge remove python3-pycurl && apt install libcurl4-openssl-dev libssl-dev<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhcn9hy9RQgOerD3nzbhmdPpfgUWBDRHo9MorvLHvgUmi6x4eogEABZPL5MjPGelRtxtkdvGv0c1yYBFyxkh7Vz7m6d1XMEMiDKBhKeN7EwaNQu8nl[...]

xcYt4dpCTEmP6Hr-AvQ5oQZSqeX11fNuh9P8K41nNHfljQk0Yn-nzImLTpmhcgpJXBLX9SiWGbA=s16000 Now, when you run wfencode, which is a module to encode a supplied input using a hash algorithm, there is no pycurl error now.<o:p ./wfencode -e md5 ignite<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjqq1FwUhY9pU7KsVeFgWVFEjx59GhZuspGzktfo74ogT826NthLSqwqKgrI2Z3Wn0t8mmsRA4j6-kX0aN9XcJHCzVmPhkElkWZH5HXBny2DTnVDnqXGkwHtJXS_U6bq8XLNb-5bLXupSYc8tht9dlnIrWm9jwUMziB7KK6Pj0kAFp5Ped_2uEKS5W5IA=s16000 Docker run wfuzz<o:pWfuzz can also be launched using docker in the following way using the repo ghcr.io. The respective command can be run by replacing the last variable wfuzz.<o:p docker run -v $(pwd)/wordlist:/wordlist/ -it ghcr.io/xmendez/wfuzz wfuzz<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgxN-5qgJ8JhMkpln3CRAF21JsgTt8Iub04WmjKxnPQXFIE3_xyEL_38AN0GbXGMROHeUc-hZ5iUUYmZH7GHCc7Cf4AvRvJN0AHYQVFVkkMDybENICGCaw7zTQ8STg4yWmQC6rdKuBFtFyUxgqAXDBn3Wk8GIWZfP8o9cwpZnOCv4GzfDyofyupoKYHnA=s16000 Payloads<o:pA payload in Wfuzz is a source of input data. The available payloads can be listed by executing:<o:p wfuzz -e payloads<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjxSHorx2LSzijihZhysIWIyUCGXO7Bm1NAoMP23LtCnoZIPr2GG75BLSta6_G4Pr3GfQdXrfWMP99vMPLtrGfEsZ7Uu65GxKrfqBjJobrLh74VNnc2uTSt1_OPHid2AbpqkSG1ESy6zxm8y8O7-u0MsEytQdHkesKPoMgz4eXNbI00m8ZJovP5WG-TLQ=s16000 The detailed view can also be looked using the slice filter:<o:p wfuzz -z help --slice "list"<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj57YLfIEglB5sRT5_R1SoxlFy00YdmwJ7ufXBui_Pjx1DPDORjwwBE4VN9pLLs8GKjAQ71TYwSrQEPg2NHmB7cu_bv_B5PA06CQaeVYS87NW7-MjU8ilwgRs1ciYUPz6s_8RRWEJ7R4WN4XsOO4ZftO5OPtD-xZJ-HOJUgRTVA9kTxJlBRajce1EdoUA=s16000 Subdomain Fuzzing<o:pSubdomain discovery is extremely helpful in pentesting scenarios. Often, attackers launch attacks on subdomains rather than main domains and it can be fuzzed like so:<o:p

Here, -c color codes the output response codes
-Z specifies a URL to be input in scan mode and ignores any connection error
-w specifies the wordlist use while subdomain bruteforce.<o:p wfuzz -c -Z -w subdomains.txt http://FUZZ.vulnweb.com<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhPJCIfwcLimqxxX3yX4CS1QzKhxKvBuWpO4wXfcz1t4PryHAeWgXf3_7g9Wt7noSF2HHXXgQ3Z_cuvQK1ZIP9pYhCbIpIMqR3lgAX5qWeFvOp7U3iKBUfMxiEd9SaEiKBzessAWoF7kUPNKqDU35oEhPFK3_r7sRj2WxR5uMhOLzuiFd0-jexIIO0nww=s16000 The same can be achieved by providing the subdomain list inline too. Only, the payload (-z option) should be supplied in with “list” as an input. The list is supplied in the format ITEM1-ITEM2-ITEM3 like so:<o:p wfuzz -z list,CVS-testphp-admin-svn http://testphp.vulnweb.com/FUZZ<o:pwfuzz -z list,CVS-testphp-admin-svn http://FUZZ.vulnweb.com/<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhOwqYT4IkngKI82XpByDIwUBwu54BiTytw0DtdOBdMlGF53oTswXa39LoQixpreYfNWpCYWHSP7cP_qMsNGbt8y80TdaoavjC620hFA_wJ3euabHB1aMaV7P4-J2tnw0K75VkF8z0th73r_EmXGP9LLfIi3boGWSGptzXJuGexIS9rSOcXEycjqsw9RQ=s16000 Directory Fuzzing<o:pDirectories can be enumerated using wfuzz just like with gobuster by using a supplied wordlist. This can be done using a -w flag and input the path of the wordlist:<o:p wfuzz -w wordlist/general/common.txt http://testphp.vulnweb.com/FUZZ<o:p https://blogger.googleusercontent.com/img/a/AVvXsEj277p_KR8uFWmQOoWgkoPe8K3Yi-BaZzkIUqp1idoIohFKozd6qk8pni1piFESdqhkwEaCxxlJ8peBlPOqapXjqQeP6y_PETEsE31YfCaJY8f0qn4WkrEnFUWnzzSa8dZfATrcxCrM7LnouCYktvGmW5yEgwvnC-4gAIDMCh2WM1ccYprIbRXEsI0Jhg=s16000 As you can see in the above screenshot, all the results including page not found have been dumped which makes it tedious to go through the results and find pin in a haystack. Therefore, to sort the results out we can see the show code flag (--sc). Other such flags are:<o:p

· --hc/sc CODE #Hide/Show by code in response<o[...]

:p

· --hl/sl NUM #ide/Show by number of lines in response<o:p

· --hw/sw NUM #ide/Show by number of words in response<o:p

· --hc/sc NUM #ide/Show by number of chars in response<o:p wfuzz -w wordlist/general/common.txt --sc 200,301 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjbd1usP52L5gE8UCIrKbnb4kSVQxslqSJNaJVfzZFfwqUodwFFq93w7yzWOd164u2FFj7vchCQ-gdurk911fsPnAprJ-atzCAUlSFPhlB5xOsEX8BFES5YhzJyaQ3QecicBOal6ZqKtqgd8hnby0_g5qshU6TlapzXmg5Po5eu0dAqridZvZsIk6soUQ=s16000 Saving fuzzing output<o:pWfuzz output can also be saved in multiple formats using the -f option.<o:p

-f option allows a user to input a file path and specify a printer (which formats the output) after a comma.<o:p wfuzz -w wordlist/general/common.txt -f /tmp/output,csv --sc 200,301 http://testphp.vulnweb.com/FUZZ<o:pcat /tmp/output<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEi0XfulNz7-1u_3z3R0lPIQRB-GtUf1MJv8KUMCyxJjAVDkc2siw5NPUuy6a_A5MK2p-L-4A9WCyqJ9C2_mxiX1Nz0p4Gv29bYt2f6kI5Bkjf7jeuBR2VlQMpvS5ni7cmObudPw9zjtG2jz_WRAZH7G3HgkZB4SxoNVaVbNh4ZZx9m8K2DFrN0b_qBBWw=s16000 In place of csv, you can specify any one of the printers<o:p wfuzz -e printers<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjdPFYA5HkCHc_leeKZz-f-z_TxEP3RcVetp4PRzOZBjtAUJFEbZZiGH55Ds0gUAorwp8Ewe6Z04YwzHSX7fHr5pC8f-GGg40S_6yTb-qLyI89_OdltKLnrT2Fzl3vEwNUS90sKAwwG8VrOQFU-F1SgQ0TFXAmksDdBdCxW8DWIR0u_iDWVbAJL3mS3Sg=s16000 Basic wordlist filters<o:pThere are certain sub-arguments that can be preceded by -z or -w filter to play around more with. These filters are:<o:p

--zP <params: Arguments for the specified payload<o:p

--zD <default: Default parameter for the specified payload<o:p

--zE <encoder: Encoder for the specified payload<o:p

So, to specify a wordlist with the payload, we can do it like so:<o:p wfuzz -z file --zD wordlist/general/common.txt --sc 200,301 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgXc7ppDQbYu3IiYF9XF2vIr6M9QJtOt7CkOqEZW_1OOPmojA6pDOOI44mk8vC9C8DmnIMobsv9Il5xGwUXSA7BMOZ2UdNJ-XeoTq94cVQg6fORFzHWUFWtPLy4TZfmsjJ9DOt4x8FqZLH2BY9vUYHGOyw1tHtaQFJ1UgkiS2LRR_uI6UgOtCcrZ8vRBg=s16000 To hide the HTTP response code 404, the same can be obtained like so:<o:p wfuzz -z file --zD wordlist/general/common.txt --hc 404 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhGro9rtqkBf95ZAAdQZl_BDAWrD8Bx3k0sbPTCo_vD6Sm8TitrqCB1yeb5y2ghBlYG5Jio-4BtOlmLuSom5-j-pfv26XuoXguv-6WQHPfY1WYOQMyjriLCkOkL6Z346lhVNxoI6XBTNkOXKiXCEhYdd1JZEFHBymAMMXG9vKrjxOGiGO8Jlf1dsbT5ow=s16000 Double fuzzing<o:pJust like a parameter in a payload can be fuzzed using the keyword “FUZZ” multiple fuzzing is also possible by specifying keywords:<o:p

· FUZ2Z - 2nd parameter<o:p

· FUZ3Z - 3rd parameter<o:p

· FUZ4Z - 4th parameter<o:p

And each parameter can be allotted its own wordlist. The first “-w” stands for first FUZZ. Second “-w” holds for second FUZ2Z and so on.<o:p wfuzz -w wordlist/general/common.txt -w wordlist/general/common.txt --hc 404 http://testphp.vulnweb.com/FUZZ/FUZ2Z<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjBI2VSfPDC_CUAs_HbkjxZj0qRLWIMBx0iJeUoZyaz0Nt6ufIEPyDnp1MoiRyI4oEGnflOtmVYqgJD4vTPB1mCFd2jI6kfdoiH3i2tJrVbNA7jbuJl4H14Q_MIWrqRswRjxFusedPrVkCBnXjZ4SiT3zrzQk9afw3g4n2JXgEDpEaaKoZ81OpruJPwcQ=s16000 Login bruteforce<o:pHTTP responses can be brute-forced using wfuzz. For example, testphp’s website makes a POST request to the backend and passes “uname” and “pass” as the arguments to a page userinfo.php<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhr3yrCTyid_S5Es9Iubhi8sQ88tlSfmOiNce3KtLJaLdanm5a4qOhIyuzn3hxTNoJem4xuMCWTTJRlyA1rfR631FFPcqtKb5lpmCWNR1cLHq8fI7QE2MHmc7-kvXSOqlubgmM2OHSplvaxCSQF5jn_JUmVtlyEGlpl85ft8qOp5Oqfzq[...]

I6_sjfKfWJJA=s16000 The same can be implemented using wfuzz like so:<o:p

-d argument specifies the post data to be sent along the request<o:p wfuzz -z file,wordlist/others/common_pass.txt -d "uname=FUZZ&pass=FUZZ"  --hc 302 http://testphp.vulnweb.com/userinfo.php<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhuLfheEAnnjVp-dUFpDUnz5flnvDZgcjk1gUK0VA2f06ywDgkJLoDddIlyUIpTwx0JAa4h1qdIo_D6o9GjUk8CiJyu2iIaIUA7tJnaCj_oeCDQPhk9xZY0JV0pKsuoyCg3D2qoWqqRcDhiq4NEWyNtcprKTQjoNwf17l7UsuI9xgG_czVxNzlYq83PEA=s16000 As you can see, the correct credentials “test-test” have been found. We used a common file for both username and password. The same can be done by providing different files for both usernames and passwords like so:<o:p

-c is to color code the output response which can be skipped.<o:p wfuzz -z file,users.txt -z file,pass.txt --sc 200 -d "uname=FUZZ&pass=FUZ2Z" http://testphp.vulnweb.com/userinfo.php<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEidjYanb-YRNHfEvkqFCl_FS0tX8yJyPJVM_fAYHy1AaIV7YiSaWLthhrf_SHlmE5U-mMzIwzjsji41-37ckAzcrfuG3_jTv6rMoUifjDe_xxUfttjpCB2U76KlIbULN987nH9-rZ_4UfYI6bntW4KUsSKzzzPIHnHcvQYBOvBRYyiDXeBVpL61jMM0eg=s16000 Cookie fuzzing<o:pTo send a custom cookie along a request to different fuzzed directories we can use the “-b” plug. This would add a cookie to the sent HTTP request.<o:p

Scenario useful:<o:p

· Cookie poisoning<o:p

· Session hijacking<o:p

· Privilege Escalation<o:p wfuzz -z file,wordlist/general/common.txt -b cookie=secureadmin -b cookie2=value2 --hc 404 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg5FcQAVag5_Vi12nW-N-jmvuo9ixifgydlaGwRZKV90t-hrcYtO6UwAMYjQ0wwiKDjhjsQrKQIz7WpMjfpctTw-XZ4i-YTFz6E0g6FM30jldlE5jQbsYSk4e35rLjtg3USRMX8Pl3dvKMzjejtBHUSl-bqM3LGnDWFjSMmDFzBL94PiZOCeoYBUxjuTA=s16000 In the above scenario, we have added 2 static cookies on multiple directories. Now, we can also fuzz the cookie parameter too like so:<o:p wfuzz -z file,wordlist/general/common.txt -b cookie=FUZZ http://testphp.vulnweb.com/<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhfprPFK37CLoJybfULVYiJum1RU9OcpSlNKzobdaEA1ZaTWbNsEzjQduPqrGuQKWNonC4slt370i2qgS5i2APRF64oWBmMbQJkFJZb6zbsgljka-HoMM9QIGwCOKWAcQiDiJHulAq0RMQjehWUQ5VlK_s8KibM1SlDqHTTHMYFN-DVvIZvj0QcPD0afQ=s16000 Header fuzzing<o:pHTTP header can be added in a request being sent out by wfuzz. HTTP headers can change the behavior of an entire web page. Custom headers can be fuzzed or injected in an outgoing request<o:p

Scenarios useful:<o:p

· HTTP Header Injections<o:p

· SQL Injections<o:p

· Host Header Injections<o:p wfuzz -z file,wordlist/general/common.txt -H "X-Forwarded-By: 127.0.0.1" -H "User-Agent: Firefox" http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhx3w1G28mcic7xy98Yv5PkaLJwMuqAHqRpeznFRiO4CeolH0tkPkktLpqtzCyXBN1zr5vLlNJ8vIfUY9G9tT424SDffxqHGyA-L0KHkalR2FdmixeIlJ__tI77v--4MQswXdLwBntYrDPGyrdfVBOIrz2BQudJHuOvOkneyl3248iQS0esmwByFOP85g=s16000 HTTP OPTIONS fuzzing<o:pThere are various HTTP Request/Options methods available which can be specified by using the “-X” flag. In the following example, We have inserted the following options in a text file called options.txt<o:p

· GET<o:p

· HEAD<o:p

· POST<o:p

· PUT<o:p

· DELETE<o:p

· CONNECT<o:p

· OPTIONS<o:p

· TRACE<o:p

· PATCH<o:p wfuzz -c -w options.txt --sc 200 -X FUZZ “http://testphp.vulnweb.com”<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh7rVvcqsW9LiyOsX7vTYxwe5ExQdaYsfVM0KZ-L2Y8V0Nl4YI6yS35sYH13-E6NKrH_Bye9LGzn1ntGofqu6cBRJ45eWgKixrQOSO5Hr1y3SfH4vpGcQb_iDpDYiMRRB9tV0GKJavyznLJSr9ef-9M6EMYzdJw3y6LiLWGAA6KFX6TSsGC82tvjas4_A=s16000 As you could see, three valid options returned a 200 response code.<o:p

The same can be input inline using [...]

the “list” payload like so:<o:p wfuzz -z list,GET-HEAD-POST-TRACE-OPTIONS -X FUZZ http://testphp.vulnweb.com/<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEi3L4sPuzrvwGbTF2PQ54kA7LIlpRUmwsu2mLZOIZO2jx45632tsJdAPHACj_Ij3cREw3qcZmEh9FAzcVdMU6zLw8J8JaskU-gWUMW9dwxxN_rTbfYvuhYdLlYXDmhjbq4zxhfjgRTtQ4fkBANkcZumFayyAPuI-lKMwjFAECoMM2RBkaJUVg9zoo8dzw=s16000 Fuzzing through Proxy<o:pWfuzz can also route the requests through a proxy. In the following example, a Burp proxy is active on port 8080 and the request intercepted in the burp intercept as you can see.<o:p wfuzz -z file,wordlist/general/common.txt -p localhost:8080 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhmW3QkG3hSsg50RJrbMZTQ-SkDFbk89p6clAzif81GIyYShwMeUfGnaPD87O58JSeXKVw3tYTgkSbsYSKIZS76MXdWotK6lA65uHZB3o8snI5o5DYsl00TsVDeo7d-sIxylo6TEwlQzZaE9SZdMHDgSTatGDdBFPdXlMGbin_uUElpUEhyzoW06A3slQ=s16000 The same can also be achieved with SOCKS proxy like so:<o:p wfuzz -z file,wordlist/general/common.txt -p localhost:9500:SOCKS5 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEi2qZaOzLJ6sJXzkyfyMXnWPt2aVbU_1DiDm64SyqcG8-qM4oymKdoTRNPQdMjYwAIQnhzZOjORhl4ob57-m3_6xuMGTXR3j5pKSlKqdBZO6MwLz1Wn066L1XghEk5f69q0JXx91FA6ASmanaUlVZU1vs8wqJ8Vkir3qp1VWL18eaBOEtpvRsmJ4jVbow=s16000 Authentication fuzz<o:pWfuzz can also set authentication headers and provide means of authentication through HTTP requests.<o:p

Flags:<o:p

· --basic: provides basic Username and Password auth<o:p

· --ntlm: windows auth<o:p

· --digest: web server negotiation through digest access<o:p

In the following example, I am providing a list inline with two variables and --basic input to bruteforce a website httpwatch.com<o:p wfuzz -z list,nonvalid-httpwatch --basic FUZZ:FUZZ https://www.httpwatch.com/httpgallery/authentication/authenticatedimage/default.aspx<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhws5prlUy-bp3BP3GYM0bmFwKclxvcpNeStoQ3QqnfVchRH_rJHOzvu6iDqRaL3UxJNn1SHlsHTyv2uV28GzDFRtMIXMf0Mp7k1Je0jQPpH3VHwa4aCMV7ymtC5MrRHR9TNitWvsAKA2lW13rpJgczib30_nve3B3RlDigj6sEFrnAjm0VgKaZ1WPclQ=s16000 Recursive fuzz<o:p-R switch can specify the levels of recursion while fuzzing directories or parameters. Recursion in simple terms means fuzzing at multiple different levels of directories like /dir/dir/dir etc<o:p

In the following example, we are recursing at level 1 with a list inline containing 3 directories: admin, CVS and cgi-bin. Note how a directory with - in its name can be supplied inline<o:p wfuzz -z list,"admin-CVS-cgi\-bin" -R1 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjCEM9ckW-_O_us6Y2I7eHdBpDkkMT9ZkwVbGDQNgN2t4sqnCo7PY6FQN8WOAVN03YD1sjqBGudOoNBshDvBpjBExFF_uq-we_9cJU3_hJ5VVCDZik-KeZZ7SoDV0t_VmeyIda0JrTG57LhTklKwJdOhFeMVcTL0qiP5V7sUoBbBtkEr6XTGGe92Mm0AQ=s16000 Printers and output<o:pPrinters in wfuzz refers to all the formats a payload’s output can be processed as. It can be viewed using -e succeeded by printers argument. Furthermore, “-o” flag can specify the format of the output too<o:p wfuzz -e printers<o:pwfuzz -o json -w wordlist/general/common.txt http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiOyEwpslOs6tMoVZ586D64PfgvCf00Ddl3Zi9-ohn0i9cKy6jDenBDzPJMspJCT_jmOaPpN-zodrcpAZDy5PfCN_2v1l9ioV6BcD3_yOAF6fSWnRX9I6n7qkvYFavA1irCUz0_W6UTWZ4ZcrdoQitTgy8nW-STDDdM_M6U6J7pessZLeER2fXO_VNndw=s16000 Encoders<o:pVarious encoders are available in wfuzz. One such encoder we saw earlier was md5. Other encoders can be viewed by using “-e” flag with encoders argument.<o:p wfuzz -e encoders<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhvBbuwsPZ7vGQjR1QqtVQZvP8I2C4t_At9RrJbn3iCvwu2H-H8LPHSqM3YG2UYKTYl39p2B2RPzelveFVXcVtNcu0[...]

4VknQnDC-tNoxDaBnQPLSxiPuyfEZJ2V26s4BuhrA4kv35gaMohPSk1xaY44Recwha7DCDuo0ejU1ocOz3jfFIHqc0h9x9juIHA=s16000 One can fuzz a website for directories by using MD5 output like so:<o:p wfuzz -z file,wordlist/general/common.txt,md5 http://testphp.vulnweb.com/FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEi75p7YlEtq-1FPh1JSxhMA7fbf5DX-PP3AU2BtavHxJANYh7usbjRJGPtGJk7rp7m5zzoMLImklbUwdlVakSijfC_LLFvsbiDecaLk2AAAnkNAsRLy_liLUF5EbipyO6NtwQa2iI8-hyXh1MI-ssddpfBE2sp_NWs0l6NNRTd5bhyCvkl02dJt_CoKuQ=s16000 Storing and restoring fuzz from recipes<o:pTo make scanning easy, wfuzz can save and restore sessions using the “--dump-recipe” and “--recipe” flag.<o:p wfuzz -w wordlist/general/common.txt --dump-recipe /tmp/recipe --sc 200,301 http://testphp.vulnweb.com/FUZZ<o:pwfuzz --recipe /tmp/recipe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj7LUElLYhpYB9IZ4t7QhgYkW_TOSbV22webF-TPlRT3jFGSVl0ohMuHHvSKaEC-VrmM-bo9uUIBwvIrtkXyWEln6wdUT4JDQtiUbSytm4t1EbWytLtZ6MAt2iZt-qnSvHoLSORsQhZ8v2Zv31s9FPesOa5UZCnk4gY7EzIH-50Cdch55GYkrWL2I_Pag=s16000 Ignoring exceptions and errors<o:pOften while fuzzing, there are various errors and exceptions that a website can throw. “-Z” option can make wfuzz ignore these errors and exceptions. First, we run a normal subdomain fuzzing routine and then with -Z option:<o:p wfuzz -z list,support-web-none http://FUZZ.google.com/<o:pwfuzz -z list,support-web-none -Z http://FUZZ.google.com/<o:pAs you could see, -Z ignores that error on the bottom. Further, any invalid response can also be hidden like so:<o:p wfuzz -z list,support-web-none -Z --hc “XXX” http://FUZZ.google.com/<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiD9jm1E8_cStPYZPaulqoSi2Y8nJdokCNIwpEWEom0sRkfGSpc2PozAZIkw9C2cUwyj8DfG0i9-Jd3Cqbo0F2cO4ZvuHKiWEAyfRUS8d5ThiUk5qBHe9GN6wjWZmbCJJ4p6dM2RavBQgRT2_8ig-Mok3YuX9Xs_EIuXb1aGKPD-2_znEeQhVYOrZGKkg=s16000 Filtering results<o:pThere are many filters available to manipulate a payload or output. <o:p wfuzz --filter-help<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjVyvyB69OSItJOJD2LS0sLdjnnchl5EcJsbNvbUgl3vjodEfcwf_OpsaGIGhC48VqEBXLAU9qsiWOf7hxTvyoQcfy7_bs46GIct9FZFJbbEfGWZc-1mTwRrSZqaYIDx-_hD3Vnal4JDxR9OcCAnnXyTvpWYN3KsDU2vGRylvnrOCiFY0nEXYccHiBvbg=s16000 These can be manipulated using “--filter, --slice, --field and --efield” arguments.<o:p

For example, to view raw responses of the payload sent and the complete HTTP request made, you can use “--efield r” option<o:p wfuzz -z range --zD 0-1 -u http://testphp.vulnweb.com/artists.php?artist=FUZZ --efield r<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhKTOILk3-hpuhZPLV_hi8Ql8uqYFTORWbtX9oSjW3_f3fVLA1ngVjYua7ageWS6JZMFUybo0u0tpw7kyxu5cRFyKdW7qNXvVgX5I68WUYrKPsytSa5xc7Ka5TTbv8o_McTFvWHtG6PjTIjs_nXRcYXkOEvC3wgQvscNrfKYmWGNx3yjLUD-Hwrs5riKg=s16000 However, if only the intended URL is needed, one can do it by providing --efield url input.<o:p wfuzz -z range --zD 0-1 -u http://testphp.vulnweb.com/artists.php?artist=FUZZ --efield url --efield h<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhJ_FwFIQmIWvrijOnnHH-0_M_7CuRXhQiXN_z0aD5hwkAhQ8ZwP5HlTVAqK4ClcZOlcRCMO3QEqpMT9Q7FnKxv-clGApz2TWArzPOL1S1N8LhzT-cD2lSEIktD7ybr19dFkPMqQdt4HWnQjKKdIrjKLXsFG3i1U6vyq1vWggdV5TYJxUHLVHdStfEN4A=s16000 Similarly, to filter out results based on the response code and the length of the page (lines greater than 97), you can do it like:<o:p wfuzz -z range,0-10 --filter "c=200 and l>97" http://testphp.vulnweb.com/listproducts.php?cat=FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhTz9IW7TuDaGR2gHYJka_pc2JkQmPAQriH1MDM5o1RXMoZAEvu9thHupG7bVCbcEGAnRU1L8PLB9q-Z-FTKDk4t7WMvMrkKF-kpoXymmlSX6370ORwRDDaP5YQxjkqq5IINGyVBM8D2CFw1oebJTy-18UQmVFZMTNgNxAk4O2HER2u6xIUBzfSPRQ_PQ=s16000 A detailed table of all the filters f[...]

or the payloads can be found here.<o:p Sessions in wfuzz<o:pA session in wfuzz is a temporary file which can be saved and later picked up, re-processed and post-processed. This is helpful in situations where one result saved already needs alterations or an analyst needs to look for something in the results. “--oF” filter can save the session output to a file.<o:p wfuzz --oF /tmp/session -z range,0-10 http://testphp.vulnweb.com/listproducts.php?cat=FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiQiKQ7sXGQnyi9B1aFwMPZyKYurNtxp-Bs8Ld3mb80cTOkw2Q6zYN5Pq2rmGaeW-mu7nuQ1_g0f4BGGz0BAug5hUspnVSUYAaDZi3z1myhncY1vKv-rpICqdTZGBt9dfM8vDjAJ9nXyi9FEHcGsgRSiQ2nQdKZKOFH0cwDHQI5uOINnzD-72oz2g9gPQ=s16000 This session file can now be opened up again and consumed using the “wfuzzp” payload like so:<o:p wfuzz -z wfuzzp,/tmp/session FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEikpddZ5GSmzRSbZmabTMNgyDR7kcrU-8LyZHru3ejhiey3fU5a_DimxLoe0Dut9A8O81m8q1oQF_f2o7rxLIHTDVx_oNOA0xdwdtu8_62OYY85Lqd21Edx2NukpaQigPIHL3dm38r2HbFaut3FWGtOwXH-QBD2aQOanQfKHhuwNQepwwrepNOnJWpYEg=s16000 One such example of this filteration from  a previously saved session is as follows where we find an SQL injection vulnerability by utilizing a Pytho regex designed to read responses after a request modifies a parameter by adding apostrophe (‘) and fuzzing again. “-A” displays a verbose output.<o:p

The regex r.params.get=+’\’  adds apostrophe (‘) in the get parameter. r stands for raw response.<o:p wfuzz -z range,1-5 --oF /tmp/session http://testphp.vulnweb.com/artists.php?artist=FUZZ<o:pwfuzz -z wfuzzp,/tmp/session --prefilter "r.params.get=+'\''" -A FUZZ<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjMhBuzyEJE4W7udyMkHvrKivAHo9h9WmGjeTdm5FJLUDkGBx53kEt7fY3pCs58J9e46QwbXyvw1dSHmG3HNx0CXZNIycUYlbDYcJwH9fqjnhLc9iEfzcX3vUE2FtVVcZ2dA_CDLJOAZ5juV-3vDyNXv7R-KA6HtgTv8N5bPyJkVREFwGG7YApGynJhJw=s16000 As you can see, request number 4 throws an SQL error which indicates SQL injection. For more regex operations refer here.<o:p Conclusion<o:pWfuzz is a versatile tool that can perform more than just directory enumeration and truly help a pentester in his analyses. It’s a fast scanner which is easy to use and coded in python for portability. Hope you liked the article. Thanks for reading.<o:p

Hacking Articles
A Detailed Guide on Wfuzz

IntroductionMany tools have been developed that create an HTTP request and allow a user to modify their contents. Fuzzing works the same way. A user can send a similar request multiple times to the server with a certain section of the request changed. When that certain section is replaced by a variable from a list or directory, it is called fuzzing.

In this article, we will learn how we can use wfuzz, which states for “Web Application Fuzzer”, which is an interesting open-source web fuzzing tool. Since its release, many people have gravitated towards wfuzz, particularly in the bug bounty scenario. So, let’s dive into this learning process. Table of content* Introduction to wfuzz
* Setup
* Wfpayload and Wfencode
* Docker run wfuzz
* Payloads
* Subdomain Fuzzing
* Directory Fuzzing
* Saving fuzzing output
* Basic wordlist filters
* Double fuzzing
* Login bruteforce
* Cookie fuzzing
* Header fuzzing
* HTTP OPTIONS fuzzing
* Fuzzing through Proxy
* Authentication fuzz
* Recursive fuzz
* Printers and output
* Encoders
* Storing and restoring fuzz from recipes
* Ignoring exceptions and errors
* Filtering results
* Sessions in wfuzz
* Conclusion Introduction to WfuzzWfuzz is a python coded application to fuzz web applications with a plethora of options. It offers various filters that allow one to replace a simple web request with a required word by replacing it with the variable “FUZZ.” SetupTo install wfuzz using pip, we can:
pip3 install wfuzz
https://blogger.googleusercontent.com/img/a/AVvXsEiNtimNpNWYyqjsIgyqKdnkiQtBUZZVLFmNVEVTGJUawPDmZo_fTSmHrldgoUaAKsW1TeLQP1BOH2LHk_BfBBoPhU-6BLxuSS7nZP9MFnvV_ZlaCPj7baUxLsxW6bmkhQP6QZKcBhuVn1DRamxenMcgodhavZkkpQYaiqdiptkjomg3CGZ63j6oplFC2Q=s16000

The same could be achieved by installing from the source using git.
git clone https://github.com/xmendez/wfuzz.git
https://blogger.googleusercontent.com/img/a/AVvXsEibwjNr9tIFE7UnFpttVMQdE8mmHE_4FL-kxIXyy3roCcSDm1Unf9CXqphA6Cjk1XC5rH8Q2-wUspCpDm4NEbXjEdqDKA3XjNGMGUN1Ce3uu4-UOrR3WeBXzwGp8gdtoFve4U5VJV84DmaPA6fFtqzVSrUqeUd_0n3Zp5kg2A96K-mbdkJOB0eGjTi3KA=s16000

The help menu to see all the working options is as follows:
wfuzz -h
wfuzz --help
https://blogger.googleusercontent.com/img/a/AVvXsEhujNJyqVzJJhKvvC0OCowqjlHUIvNRz9BHV-ZrUZ2Eo8WRR70rpxpWrWhyx3UR8awBM-CTgXGLvjRDbrfmfFj2CbzMN5_LuTe_9icB4HJrsfrb5cGgW77A-hwxPVsxxGhNwYrhkAlhPQY8VoNrUfnv7frInrD1vhtozHJo49kWv38D7oIH81VRP6XNcA=s16000

You can use a module by using “-z” Wfpayload and WfencodeWhen you install the tool from the source, compiled executables called wfpayload and wfencode are available. These are responsible for payload generation and encoding. They can be individually used. For example, the command to generate digits from 0 to 15 is as follows:
./wfpayload -z range,0-15
https://blogger.googleusercontent.com/img/a/AVvXsEhyEj6pgrzNFjgW2gtePPSS31QKt-1nKoWgJILHMC3wrWO47VP50IzNqvmOw7gRG9vq_gz4zlWjsVBdGvCpKy__SOzxGnNXMbe_Mdx34-RWn3tP-EBD99szQJX7S7EQsVzU_fNqAvN8xHgN7K9Kjvw9-ibEVRrIIN8_PehPJ2i_TO0W9sUe85nxa3NVOQ=s16000

As you can see, there is a pycurl error. It can go away like so:
apt --purge remove python3-pycurl && apt install libcurl4-openssl-dev libssl-dev
https://blogger.googleusercontent.com/img/a/AVvXsEhcn9hy9RQgOerD3nzbhmdPpfgUWBDRHo9MorvLHvgUmi6x4eogEABZPL5MjPGelRtxtkdvGv0c1yYBFyxkh7Vz7m6d1XMEMiDKBhKeN7EwaNQu8nlxcYt4dpCTEmP6Hr-AvQ5oQZSqeX11fNuh9P8K41nNHfljQk0Yn-nzImLTpmhcgpJXBLX9SiWGbA=s16000

Now, when you run wfencode, which is a module to encode a supplied input using a hash algorithm, there is no pycurl error now.
./wfencode -e md5 ignite
https://blogger.googleusercontent.com/img/a/AVvXsEjqq1FwUhY9pU7KsVeFgWVFEjx59GhZuspGzktfo74ogT826NthLSqwqKgrI2Z3Wn0t8mmsRA4j6-kX0aN9XcJHCzVmPhkElkWZH5HXBny2DTnVDnqXGkwHtJXS_U6bq8XLNb-5bLXupSYc8tht9dlnIrWm9jwUMziB7KK6Pj0kAF[...]

p5Ped_2uEKS5W5IA=s16000 Docker run wfuzzWfuzz can also be launched using docker in the following way using the repo ghcr.io. The respective command can be run by replacing the last variable wfuzz.
docker run -v $(pwd)/wordlist:/wordlist/ -it ghcr.io/xmendez/wfuzz wfuzz
https://blogger.googleusercontent.com/img/a/AVvXsEgxN-5qgJ8JhMkpln3CRAF21JsgTt8Iub04WmjKxnPQXFIE3_xyEL_38AN0GbXGMROHeUc-hZ5iUUYmZH7GHCc7Cf4AvRvJN0AHYQVFVkkMDybENICGCaw7zTQ8STg4yWmQC6rdKuBFtFyUxgqAXDBn3Wk8GIWZfP8o9cwpZnOCv4GzfDyofyupoKYHnA=s16000 PayloadsA payload in Wfuzz is a source of input data. The available payloads can be listed by executing:
wfuzz -e payloads
https://blogger.googleusercontent.com/img/a/AVvXsEjxSHorx2LSzijihZhysIWIyUCGXO7Bm1NAoMP23LtCnoZIPr2GG75BLSta6_G4Pr3GfQdXrfWMP99vMPLtrGfEsZ7Uu65GxKrfqBjJobrLh74VNnc2uTSt1_OPHid2AbpqkSG1ESy6zxm8y8O7-u0MsEytQdHkesKPoMgz4eXNbI00m8ZJovP5WG-TLQ=s16000

The detailed view can also be looked at using the slice filter:
wfuzz -z help --slice "list"
https://blogger.googleusercontent.com/img/a/AVvXsEj57YLfIEglB5sRT5_R1SoxlFy00YdmwJ7ufXBui_Pjx1DPDORjwwBE4VN9pLLs8GKjAQ71TYwSrQEPg2NHmB7cu_bv_B5PA06CQaeVYS87NW7-MjU8ilwgRs1ciYUPz6s_8RRWEJ7R4WN4XsOO4ZftO5OPtD-xZJ-HOJUgRTVA9kTxJlBRajce1EdoUA=s16000 Subdomain FuzzingSubdomain discovery is extremely helpful in pentesting scenarios. Often, attackers launch attacks on subdomains rather than main domains and it can be fuzzed like so:

Here, -c color codes the output response codes
-Z specifies a URL to be input in scan mode and ignores any connection error
-w specifies the wordlist use while subdomain bruteforce.
wfuzz -c -Z -w subdomains.txt http://FUZZ.vulnweb.com
https://blogger.googleusercontent.com/img/a/AVvXsEhPJCIfwcLimqxxX3yX4CS1QzKhxKvBuWpO4wXfcz1t4PryHAeWgXf3_7g9Wt7noSF2HHXXgQ3Z_cuvQK1ZIP9pYhCbIpIMqR3lgAX5qWeFvOp7U3iKBUfMxiEd9SaEiKBzessAWoF7kUPNKqDU35oEhPFK3_r7sRj2WxR5uMhOLzuiFd0-jexIIO0nww=s16000

The same can be achieved by providing the subdomain list inline too. Only, the payload (-z option) should be supplied in with “list” as an input. The list is supplied in the format ITEM1-ITEM2-ITEM3 like so:
wfuzz -z list,CVS-testphp-admin-svn http://testphp.vulnweb.com/FUZZ
wfuzz -z list,CVS-testphp-admin-svn http://FUZZ.vulnweb.com/
https://blogger.googleusercontent.com/img/a/AVvXsEhOwqYT4IkngKI82XpByDIwUBwu54BiTytw0DtdOBdMlGF53oTswXa39LoQixpreYfNWpCYWHSP7cP_qMsNGbt8y80TdaoavjC620hFA_wJ3euabHB1aMaV7P4-J2tnw0K75VkF8z0th73r_EmXGP9LLfIi3boGWSGptzXJuGexIS9rSOcXEycjqsw9RQ=s16000 Directory FuzzingDirectories can be enumerated using wfuzz just like with gobuster by using a supplied wordlist. This can be done using a -w flag and inputting the path of the wordlist:
wfuzz -w wordlist/general/common.txt http://testphp.vulnweb.com/FUZZ
https://blogger.googleusercontent.com/img/a/AVvXsEj277p_KR8uFWmQOoWgkoPe8K3Yi-BaZzkIUqp1idoIohFKozd6qk8pni1piFESdqhkwEaCxxlJ8peBlPOqapXjqQeP6y_PETEsE31YfCaJY8f0qn4WkrEnFUWnzzSa8dZfATrcxCrM7LnouCYktvGmW5yEgwvnC-4gAIDMCh2WM1ccYprIbRXEsI0Jhg=s16000

As you can see in the above screenshot, all the results including page not found have been dumped which makes it tedious to go through the results and find pin in a haystack. Therefore, to sort the results out we can see the show code flag (–sc). Other such flags are:

* –hc/sc CODE #Hide/Show by code in response
* –hl/sl NUM #ide/Show by number of lines in response
* –hw/sw NUM #ide/Show by number of words in response
* –hc/sc NUM #ide/Show by number of chars in response
wfuzz -w wordlist/general/common.txt --sc 200,301 http://testphp.vulnweb.com/FUZZ
https://blogger.googleusercontent.com/img/a/AVvXsEjbd1usP52L5gE8UCIrKbnb4kSVQxslqSJNaJVfzZFfwqUodwFFq93w7yzWOd164u2FFj7vchCQ-gdurk911fsPnAprJ-atzCAUlSFPhlB5xOsEX8BFES5YhzJyaQ3QecicBOal6ZqKtqgd8hnby0_g5qshU6TlapzXmg5Po5eu0dAqridZvZsIk6soUQ=s16000 Saving fuzzing outputWfuzz output can also be saved in multiple formats using the -f option.

-f option allows a user to input a f[...]