From 55662e607a80ab0d3d5980d315387e8a4f0ba714 Mon Sep 17 00:00:00 2001
From: Tapio Vuorinen <delic@imordnilap.net>
Date: Mon, 2 Sep 2019 14:18:36 +0000
Subject: [PATCH] Http verb fuzzing (#57)

* typo fix

* Allow fuzzing of http method. Resolves #54
---
 README.md            | 2 +-
 main.go              | 9 ++++++---
 pkg/runner/simple.go | 5 +++++
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 54af086..56f4b38 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ Heavily inspired by the great projects [gobuster](https://github.com/OJ/gobuster
 ## Features
 
  - Fast!
- - Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values
+ - Allows fuzzing of HTTP header values, HTTP method, POST data, and different parts of URL, including GET parameter names and values
  - Silent mode (`-s`) for clean output that's easy to use in pipes to other processes.
  - Modularized architecture that allows integration with existing toolchains with reasonable effort
  - Easy-to-add filters and matchers (they are interoperable)
diff --git a/main.go b/main.go
index b76c273..67b1317 100644
--- a/main.go
+++ b/main.go
@@ -284,7 +284,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 		}
 	}
 
-	// Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything bug GET, NOOP
+	// Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything but GET, NOOP
 	if conf.Method == "GET" {
 		if len(conf.Data) > 0 {
 			conf.Method = "POST"
@@ -293,7 +293,10 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 
 	conf.CommandLine = strings.Join(os.Args, " ")
 
-	//Search for keyword from URL and POST data too
+	//Search for keyword from HTTP method, URL and POST data too
+	if conf.Method == "FUZZ" {
+		foundkeyword = true
+	}
 	if strings.Index(conf.Url, "FUZZ") != -1 {
 		foundkeyword = true
 	}
@@ -302,7 +305,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
 	}
 
 	if !foundkeyword {
-		errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, URL or POST data, nothing to do"))
+		errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, method, URL or POST data, nothing to do"))
 	}
 
 	return errs.ErrorOrNil()
diff --git a/pkg/runner/simple.go b/pkg/runner/simple.go
index 8df8086..95eb0d1 100644
--- a/pkg/runner/simple.go
+++ b/pkg/runner/simple.go
@@ -46,6 +46,11 @@ func NewSimpleRunner(conf *ffuf.Config) ffuf.RunnerProvider {
 
 func (r *SimpleRunner) Prepare(input []byte) (ffuf.Request, error) {
 	req := ffuf.NewRequest(r.config)
+	// should we fuzz the http method
+	if r.config.Method == "FUZZ" {
+		req.Method = string(input)
+	}
+
 	for h, v := range r.config.StaticHeaders {
 		req.Headers[h] = v
 	}