> For the complete documentation index, see [llms.txt](https://dika-maulidal.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dika-maulidal.gitbook.io/home/offensive/fuzzing.md). # Fuzzing ## Fuzzing ? Fuzzing (atau *fuzz testing*) adalah teknik otomatisasi pengujian keamanan perangkat lunak dengan cara mengirimkan data input yang acak, tidak valid, atau tidak terduga (*wordlist*) ke suatu sistem untuk menemukan celah keamanan, kesalahan logis, atau direktori tersembunyi. ## Directory Fuzzing | Field | Value | | ---------- | --------------------------------------------------------------------------------------------------------- | | Definisi | Teknik *brute-force* untuk menemukan direktori/folder tersembunyi pada web server menggunakan *wordlist*. | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL), `-t` (Jumlah threads, misal `-t 200`) | | Keyword | `FUZZ` (Ditempatkan pada URL untuk menunjukkan posisi yang akan di-*bruteforce*) | | Command | `ffuf -w wordlist/dicc.txt:FUZZ -u https://example.com/FUZZ` | 
$ ffuf -w wordlist/dicc.txt:FUZZ -u https://example.com/FUZZ

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://example.com/FUZZ
 :: Wordlist         : FUZZ: C:\Users\USER\Desktop\wordlist\dicc.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

admin                   [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 95ms]
assets                  [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 104ms]
backup                  [Status: 403, Size: 0, Words: 1, Lines: 1, Duration: 78ms]
:: Progress: [4614/4614] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:10] :: Errors: 0 ::
## Extension Fuzzing | Field | Value | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik untuk mengetahui ekstensi file (misal: `.php`, `.html`, `.aspx`) yang digunakan server dengan melakukan *brute-force* pada nama file umum (contoh: `index`). | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL) | | Keyword | `FUZZ` (Ditempatkan di bagian ekstensi, contoh: `indexFUZZ`. Jika wordlist sudah mengandung titik/dot, tidak perlu menambahkan titik secara manual). | | Command | `ffuf -w seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://SERVER_IP:PORT/blog/indexFUZZ` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://SERVER_IP:PORT/blog/indexFUZZ /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://SERVER_IP:PORT/blog/indexFUZZ :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/Web-Content/web-extensions.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 ________________________________________________ .php [Status: 200, Size: 153, Words: 12, Lines: 5, Duration: 85ms] .phps [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 90ms] :: Progress: [39/39] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:01] :: Errors: 0 :: ``` ## Page Fuzzing | Field | Value | | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik *brute-force* untuk menemukan file atau halaman tersembunyi dengan ekstensi yang sudah diketahui (misal: `.php`) di dalam suatu direktori. | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL) | | Keyword | `FUZZ` (Ditempatkan pada bagian nama file sebelum ekstensi, contoh: `FUZZ.php`) | | Command | `ffuf -w seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/blog/FUZZ.php /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : GET :: URL : http://SERVER_IP:PORT/blog/FUZZ.php :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403,405,500 ________________________________________________ index [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 95ms] REDACTED [Status: 200, Size: 465, Words: 42, Lines: 15, Duration: 104ms] :: Progress: [87650/87650] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:10] :: Errors: 0 :: ``` ## Recursive Fuzzing | Field | Value | | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik otomatis di mana scanner akan melakukan fuzing lanjutan pada setiap direktori atau sub-direktori baru yang berhasil ditemukan (membentuk *scanning tree*). | | Opsi Utama | `-recursion` (Mengaktifkan mode rekursif), `-recursion-depth` (Batas kedalaman scan), `-e` (Menambahkan ekstensi spesifik), `-v` (Verbose, untuk melihat *full URL*). | | Keyword | `FUZZ` | | Command | `ffuf -w seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://SERVER_IP:PORT/FUZZ -recursion -recursion-depth 1 -e .php -v /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : GET :: URL : http://SERVER_IP:PORT/FUZZ :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/Web-Content/directory-list-2.3-small.txt :: Extensions : .php :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403 ________________________________________________ [Status: 200, Size: 986, Words: 423, Lines: 56] | URL | http://SERVER_IP:PORT/ * FUZZ: [INFO] Adding a new job to the queue: http://SERVER_IP:PORT/forum/FUZZ [Status: 200, Size: 986, Words: 423, Lines: 56] | URL | http://SERVER_IP:PORT/index.php * FUZZ: index.php [Status: 301, Size: 326, Words: 20, Lines: 10] | URL | http://SERVER_IP:PORT/blog | --> | http://SERVER_IP:PORT/blog/ * FUZZ: blog [Status: 200, Size: 0, Words: 1, Lines: 1] | URL | http://SERVER_IP:PORT/blog/index.php * FUZZ: index.php :: Progress: [175302/175302] :: Job [2/2] :: 5843 req/sec :: Duration: [0:00:30] :: Errors: 0 :: ``` ## Sub-domains Fuzzing | Field | Value | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik menemukan sub-domain aktif yang terhubung ke record DNS publik dengan melakukan *brute-force* nama sub-domain pada target domain utama. | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL) | | Keyword | `FUZZ` (Ditempatkan di depan domain utama, contoh: `https://FUZZ.target.com/`) | | Command | `ffuf -w seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.inlanefreight.com/ /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : GET :: URL : https://FUZZ.inlanefreight.com/ :: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403,405,500 ________________________________________________ support [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 381ms] ns3 [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 385ms] blog [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 402ms] my [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 180ms] www [Status: 200, Size: 22266, Words: 2903, Lines: 316, Duration: 589ms] :: Progress: [5000/5000] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:08] :: Errors: 0 :: ``` ## Vhosts Fuzzing | Field | Value | | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik menemukan *Virtual Hosts* (VHosts) tersembunyi pada IP server yang sama dengan melakukan *brute-force* pada HTTP *Header* (`Host:`), tanpa perlu mendaftarkannya di file `/etc/hosts`. | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL), `-H` (Menentukan HTTP Header spesifik) | | Keyword | `FUZZ` (Ditempatkan di dalam nilai *header* `Host`, contoh: `'Host: FUZZ.academy.htb'`) | | Command | `ffuf -w seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb'` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:PORT/ -H 'Host: FUZZ.academy.htb' /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : GET :: URL : http://academy.htb:PORT/ :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/DNS/subdomains-top1million-5000.txt :: Header : Host: FUZZ.academy.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403 ________________________________________________ mail2 [Status: 200, Size: 900, Words: 423, Lines: 56, Duration: 45ms] dns2 [Status: 200, Size: 900, Words: 423, Lines: 56, Duration: 52ms] ns3 [Status: 200, Size: 900, Words: 423, Lines: 56, Duration: 40ms] admin [Status: 200, Size: 2420, Words: 1205, Lines: 185, Duration: 60ms] :: Progress: [5000/5000] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:09] :: Errors: 0 :: ``` ## Parameter Fuzzing (GET) | Field | Value | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik *brute-force* untuk menemukan nama parameter HTTP GET yang valid (tersembunyi) yang dilewatkan melalui URL (setelah tanda `?`). | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL), `-fs` (Filter ukuran/size response tertentu untuk menyaring *false positives*). | | Keyword | `FUZZ` (Ditempatkan sebagai nama parameter sebelum tanda `=`, contoh: `?FUZZ=key`) | | Command | `ffuf -w seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs 798` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key -fs 798 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : GET :: URL : http://admin.academy.htb:PORT/admin/admin.php?FUZZ=key :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403 :: Filter : Response size: 798 ________________________________________________ id [Status: 200, Size: 842, Words: 310, Lines: 28, Duration: 42ms] :: Progress: [2588/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:05] :: Errors: 0 :: ``` ## Parameter Fuzzing (POST) | Field | Value | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Definisi | Teknik *brute-force* untuk menemukan nama parameter HTTP POST yang valid (tersembunyi) yang dikirimkan di dalam *body data* request, bukan melalui URL. | | Opsi Utama | `-w` (Wordlist), `-u` (Target URL), `-X POST` (Metode request), `-d` (POST data field), `-H` (Menentukan Header), `-fs` (Filter ukuran/size response). | | Keyword | `FUZZ` (Ditempatkan sebagai nama parameter di dalam data field, contoh: `-d 'FUZZ=key'`) | | Command | `ffuf -w seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs 798` | ```bash $ ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:PORT/admin/admin.php -X POST -d 'FUZZ=key' -H 'Content-Type: application/x-www-form-urlencoded' -fs 798 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v1.1.0-git ________________________________________________ :: Method : POST :: URL : http://admin.academy.htb:PORT/admin/admin.php :: Wordlist : FUZZ: /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt :: Header : Content-Type: application/x-www-form-urlencoded :: Data : FUZZ=key :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200,204,301,302,307,401,403 :: Filter : Response size: 798 ________________________________________________ id [Status: 200, Size: 846, Words: 315, Lines: 29, Duration: 44ms] :: Progress: [2588/2588] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:05] :: Errors: 0 :: ```