How to perform Effective fuzzing
What is fuzzing?
It is a technique used to discover vulnerabilities in software by providing invalid, unexpected, or random data as input to a computer program. An Active Content Discovery Method.
We start with domain.com but how do we find 1) domain.com/potentially/vulnerable/page, 2) domain.com/?vulnerableParameter= or 3)domain.com/secretPasswords.bak?
Popular fuzzing tools include: ffuf, Wfuzz, Burpsuite Intruder, feroxbuster, GoBuster, dirb, dirbuster etc
What's a wordlist?
● It's… A list of words. Usually used for brute-forcing* something
I will be answering these 3 questions
1)Where to fuzz
2)With what wordlist to fuzz(focus area)
3)How to fuzz(a few techniques)
1)Where to Fuzz

1

Subdomain enumeration
https://FUZZ.target.com and http://FUZZ.target.com

2

Path guessing
https://xyz.target.com/FUZZ

3

Parameter guessing
https://xyz.target.com?FUZZ=

4

Header guessing(HTTP request headers fuzzing)
ffuf -w wordlist.txt -u http://example.com/FUZZ -H "FUZZ: 127.0.0.1"

5

Authentication guessing
username and passwords guessing

6

API method guessing etc etc
Difference between pre-baked and custom wordlists
○ Everyone uses them
○ They're generally generic
○ They're often very large* (we're trying to save time and resources, remember?)
○ You need custom wordlists if you want to find things others don't .Every target has things specific to them.
○ Generic wordlists probably won't contain
/TargetName_storage
○ Specific use-cases call for specific wordlists. No point using a subdomain list when you're guessing headers*
Some popular pre-baked wordlists

GitHub

GitHub - danielmiessler/SecLists: SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, pas...

wordlists.assetnote.io

Assetnote Wordlists

Wordlists that are up to date and effective against the most popular technologies on the internet.

GitHub

GitHub - orwagodfather/WordList

Contribute to orwagodfather/WordList development by creating an account on GitHub.

2)How to make this custom wordlist
"To get bugs before other people, and to find bugs you wouldn't have beforehand, you need higher quality wordlists, and wordlists specific to the task you're trying to complete."
what we need in order to make a target-specific custom wordlists:
1)A need
2)A Source of data
3)A way to Process this data
4)A way to use this wordlist
ex:
1)Purpose of creating wordlist
CREATING A PATH GUESSING WORDLIST
2)source of data (getting path data)
● We want lots of URLs for the target
● Your Burp Suite history is a good source
○ Target tab > Site map -> Right click a host -> 'Copy URLs in this host'
● gau (​https://github.com/lc/gau​) to get URLs from the Wayback Machine etc
●Remember to include paths from all of your target's domains! ○ Sometimes a boring path on one host is an interesting path on another :)
3)One of those methods to process this data
—> gau example.com | unfurl -u paths > paths.txt
extract all the parts
—> sed 's#/#\n#g' paths.txt | sort -u
Bro! I am a bit lazy
Firefox Plugins to Build URL Wordlist
​Google Auto Load​ — allows automatically load next google page without need to click “More Results” button. As far as we know, instead of clicking page number, the Google Search engine have changed it to load more results.
​FoxScroller​ — plugin which goes hand in hand with previous one. It basically allows the browser to automatically scroll to the end of the page by the click of the button.
By default, it is pretty slow to scroll, but you can modify its speed easily:
​Link Gopher​ — extracts the URLs from the current page. This is the last part of this URL wordlist building puzzle. I use it when my scroll ends to the last google results page.
Now we can combine all 3 Firefox plugins to gather URLs of single target:
Bro I am too lazy
A javascript book marklet that will extract all endpoints (starting with /) from your current DOM and from all the all the external script sources embedded on the page.
Just copy the code, and save it as a new bookmark. When you visit the page you want to make a wordlist for, click it and done!
LETS SEE A QUICK DEMO NOW
BRO I AM TOO TOO LAZY!
Making Parameters Wordlist:
Use katana to extract params. you have this, apply this wordlist to other subdomains using a tool like Arjun to find new parameters which could be vulnerable.
Need some more words in your wordlist, then do this
  • What tech stacks are they using? try adding techs to your wordlists (ex: if your target is using nginx, they add some words containing Default nginx Endpoints like nginx.conf)
  • What industry are they a part of? if you're hacking an aeroplane company, try adding words related to aviation!
  • What countries do they operate in or sell products in? Add things like country names or abbreviations.
  • Do they have specific unique patterns in the URLs you can see? If you see /companyName_storage, try adding words to your list that start with /companyName_
3)How to fuzz
LETS LEARN SOME MORE COOL fuzzing techniques

GitHub

GitHub - glitchedgitz/cook: A wordlist framework to fullfill your kinks with your wordlists. For security researchers, bug bounty and hackers.

A wordlist framework to fullfill your kinks with your wordlists. For security researchers, bug bounty and hackers. - GitHub - glitchedgitz/cook: A wordlist framework to fullfill your kinks with yo...

VERY USEFUL TIP : Scan as per the target specifications and avoid aggressive scanning.
tool_name -h | grep -i "(rate|limit|throttle|delay)"

Intigriti

Aggressive scanning in bug bounty (and how to avoid it)

What is excessive scanning / intrusive testing? How can you avoid it? Learn about the importance of adhering to program requirements and the rules of engagement in bug bounty. In this article, we'll configure and test some common web hacking tools to ensure the requests are rate-limited and stay within the maximum requests per second permitted by the program.

References what I have used:
(tomnomnom talk at nahamcon)
3)few fuzzing bugbountytips from twitter(X)
(from @GodfatherOrwa, @hacker_ (corben leo) )
Thank you
Made with Gamma