WFuzz - Cheatsheet

# Nedir:
WFuzz, HTTP parametrelerini, dizinleri, dosyaları, header alanlarını ve veri payload’larını brute‑force ederek gizli parametreler, LFI/RFI/XSS/IDOR ve yetkisiz erişim yüzeylerini ortaya çıkaran çok yönlü bir fuzzing motorudur.

# Daha detaylı incelemek isterseniz Turkhacks Resmi Github reposundan bakabilirsiniz.

Markdown (GitHub flavored):

### Turkhacks.com | Bug Researchers Team
GitHub: https://github.com/turkhacks-com
WFuzz GitHub: https://github.com/xmendez/wfuzz


# TEMEL PARAMETRE FUZZING

## Basit parametre brute‑force
wfuzz -c -z file,/path/to/wordlist.txt --hc 404 http://target.com/FUZZ

## GET parametresi fuzzing
wfuzz -c -z file,/path/to/wordlist.txt http://target.com/page.php?id=FUZZ

## Belirli parametre adı üzerinde fuzzing
wfuzz -c -z file,/path/to/wordlist.txt http://target.com/search?query=FUZZ

---

# POST / FORM FUZZING

## POST isteği ile parola alanı brute‑force
wfuzz -c -z file,/path/to/wordlist.txt --hc 404 -X POST -d "username=admin&password=FUZZ" http://target.com/login

## HTML dosya uzantıları üzerinden fuzzing
wfuzz -c -z file,/path/to/wordlist.txt -u "http://target.com/page?file=FUZZ.html"

---

# HEADER / ADVANCED

## Özel HTTP header fuzzing
wfuzz -c -z file,/path/to/wordlist.txt --header "X-Custom-Header: FUZZ" http://target.com

## Verbose mod (detaylı çıktı)
wfuzz -c -v -z file,/path/to/wordlist.txt http://target.com/FUZZ

---

# İpuçları

wfuzz, httpx sonrası gizli endpoint ve parametre keşfi için en etkili araçlardan biridir
IDOR, LFI ve yetki atlama testlerinde FUZZ değişkeni kritik rol oynar
ffuf’a göre daha manuel ama daha esnektir

**WFuzz Cheatsheet – Quick Reference**

| Task | Common Flags | Example |
|------|--------------|---------|
| **Basic fuzzing** | `--payload` (or `--payload-file`) | `wfuzz -c -u http://example.com/login.php?username=WFUZZ-1&password=WFUZZ-2 -w /usr/share/wordlists/rockyou.txtw` |
| **Login brute‑force** | `-d` (data payload) | `wfuzz -c -u http://example.com/login.php -d "user=WFUZZ1&pass=WFUZZ2" -w /usr/share/wordlists/rockyou.txtass` |
| **Directory & file enumeration** | `-w` (wordlist) | `wfuzz -c -u http://example.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt` |
| **Single parameter fuzzing** | `-w` | `wfuzz -c -u http://example.com/api?query=WFUZZ -w /usr/share/wordlists/latin.txt` |
| **Multiple parameters** | `-d` | `wfuzz -c -u http://example.com/api -d "q=WFUZZ1&lang=WFUZZ2" -w /usr/share/wordlists/latin.txt:q:lang` |
| **Use a pre‑built payload set** | `-p` | `wfuzz -c -u http://example.com/FUZZ -p /usr/share/wordlists/urls.txt` |
| **Check response length** | `-S` | `wfuzz -c -u http://example.com/FUZZ -w /usr/share/wordlists/urls.txt -S` |
| **Only specific HTTP status codes** | `-o` | `wfuzz -c -u http://example.com/FUZZ -w /usr/share/wordlists/urls.txt -o 200,302` |
| **Output to file** | `-o` (overwrite) or `-A` (append) | `wfuzz -c -u http://example.com/FUZZ -w /usr/share/wordlists/urls.txt -o output.txt` |
| **Basic auth** | `--user` / `--pass` | `wfuzz -c -u http://example.com/api -w /usr/share/wordlists/api.txt --user admin --pass admin` |
| **Custom headers** | `-H` | `wfuzz -c -u http://example.com/FUZZ -w /usr/share/wordlists/urls.txt -H "X-Custom: value"` |

### Quick Tips
- **WFUZZ token**
Use `WFUZZ1`, `WFUZZ2`, … for multiple placeholders.
- **Performance**
`-t 20` – increase threads to speed up runs (watch CPU/latency).
- **Logging**
Use `--log` to keep a detailed trace.
- **Exclude patterns**
`-N` – ignore lines that match a regex.

For a full list of options, run `wfuzz -h` in the terminal. Happy fuzzing!

Eline sağlık

Eline sağlık, teşekkürler

Teşekkürler