foglar/ffuff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Http verb fuzzing (#57)

Browse Source 
* typo fix

* Allow fuzzing of http method. Resolves #54
This commit is contained in:
Tapio Vuorinen 2019-09-02 14:18:36 +00:00 committed by Joona Hoikkala
parent 08c4cb4f6f
commit 55662e607a
3 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -17,7 +17,7 @@ Heavily inspired by the great projects [gobuster](https://github.com/OJ/gobuster
## Features ## Features
- Fast! - Fast!
- Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values - Allows fuzzing of HTTP header values, HTTP method, POST data, and different parts of URL, including GET parameter names and values
- Silent mode (`-s`) for clean output that's easy to use in pipes to other processes. - Silent mode (`-s`) for clean output that's easy to use in pipes to other processes.
- Modularized architecture that allows integration with existing toolchains with reasonable effort - Modularized architecture that allows integration with existing toolchains with reasonable effort
- Easy-to-add filters and matchers (they are interoperable) - Easy-to-add filters and matchers (they are interoperable)

9
main.go
View File

@ -284,7 +284,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
} }
} }
// Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything bug GET, NOOP // Handle copy as curl situation where POST method is implied by --data flag. If method is set to anything but GET, NOOP
if conf.Method == "GET" { if conf.Method == "GET" {
if len(conf.Data) > 0 { if len(conf.Data) > 0 {
conf.Method = "POST" conf.Method = "POST"
@ -293,7 +293,10 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
conf.CommandLine = strings.Join(os.Args, " ") conf.CommandLine = strings.Join(os.Args, " ")
//Search for keyword from URL and POST data too //Search for keyword from HTTP method, URL and POST data too
if conf.Method == "FUZZ" {
foundkeyword = true
}
if strings.Index(conf.Url, "FUZZ") != -1 { if strings.Index(conf.Url, "FUZZ") != -1 {
foundkeyword = true foundkeyword = true
} }
@ -302,7 +305,7 @@ func prepareConfig(parseOpts *cliOptions, conf *ffuf.Config) error {
} }
if !foundkeyword { if !foundkeyword {
errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, URL or POST data, nothing to do")) errs.Add(fmt.Errorf("No FUZZ keyword(s) found in headers, method, URL or POST data, nothing to do"))
} }
return errs.ErrorOrNil() return errs.ErrorOrNil()

5
pkg/runner/simple.go
View File

@ -46,6 +46,11 @@ func NewSimpleRunner(conf *ffuf.Config) ffuf.RunnerProvider {
func (r *SimpleRunner) Prepare(input []byte) (ffuf.Request, error) { func (r *SimpleRunner) Prepare(input []byte) (ffuf.Request, error) {
req := ffuf.NewRequest(r.config) req := ffuf.NewRequest(r.config)
// should we fuzz the http method
if r.config.Method == "FUZZ" {
req.Method = string(input)
}
for h, v := range r.config.StaticHeaders { for h, v := range r.config.StaticHeaders {
req.Headers[h] = v req.Headers[h] = v
} }