Http verb fuzzing (#57)

* typo fix

* Allow fuzzing of http method. Resolves #54

README.md

@@ -17,7 +17,7 @@ Heavily inspired by the great projects [gobuster](https://github.com/OJ/gobuster
 ## Features
 
  - Fast!
- - Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values
+ - Allows fuzzing of HTTP header values, HTTP method, POST data, and different parts of URL, including GET parameter names and values
  - Silent mode (`-s`) for clean output that's easy to use in pipes to other processes.
  - Modularized architecture that allows integration with existing toolchains with reasonable effort
  - Easy-to-add filters and matchers (they are interoperable)

main.go

@@ -284,7 +284,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 		}
 	}
 
-	// Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything bug GET, NOOP
+	// Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything but GET, NOOP
 	if conf.Method == "GET" {
 		if len(conf.Data) > 0 {
 			conf.Method = "POST"
@@ -293,7 +293,10 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 
 	conf.CommandLine = strings.Join(os.Args, " ")
 
-	//Search for keyword from URL and POST data too
+	//Search for keyword from HTTP method, URL and POST data too
+	if conf.Method == "FUZZ" {
+		foundkeyword = true
+	}
 	if strings.Index(conf.Url, "FUZZ") != -1 {
 		foundkeyword = true
 	}
@@ -302,7 +305,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 	}
 
 	if !foundkeyword {
-		errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, URL or POST data, nothing to do"))
+		errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, method, URL or POST data, nothing to do"))
 	}
 
 	return errs.ErrorOrNil()

pkg/runner/simple.go

@@ -46,6 +46,11 @@ func NewSimpleRunner(conf *ffuf.Config) ffuf.RunnerProvider {
 
 func (r *SimpleRunner) Prepare(input []byte) (ffuf.Request, error) {
 	req := ffuf.NewRequest(r.config)
+	// should we fuzz the http method
+	if r.config.Method == "FUZZ" {
+		req.Method = string(input)
+	}
+
 	for h, v := range r.config.StaticHeaders {
 		req.Headers[h] = v
 	}