CtrlK
Pentest Notes / Enumeration / Tools
ffuf
Directory Enumeration
ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://[MACHINE_IP]
| Flag | Description |
|---|---|
| -e | file extensions to scan for: .php, .js, .txt, .html |
| -H | Set header to pass along. |
| -recursion | to follow the redirect that it received as a response to the sent request. |
| -recursion-depth 2 | Limits fuzzing to 2 levels deep |
| -rate 100 | Requests per second |
| -timeout | Set timeout time for each request |
| -ic | Ignore comments |
Parameter and Value Fuzzing
GET
Add FUZZ in the URL itself (escape & with </span> if needed: ¶m=FUZZ )
POST: additional headers with data
-X POST
-H "Content-Type: application/x-www-form-urlencoded"
-d "param=FUZZ"
Subdomain Enumeration
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.[domain]" -u http://[MACHINE_IP]
use ip address, sometimes the name wont work even after adding it to /etc/hosts
Filter by size of response:
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -fs {size} -H "Host: FUZZ.[domain]" -u http://[MACHINE_IP]