fuzzuli

command module

v1.1.4 Latest Latest Go to latest Published: Jul 16, 2023 License: MIT Imports: 16 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/musana/fuzzuli

Links

Open Source Insights

README ¶

fuzzuli

Motivation • Background • Installation • Usage • Running fuzzuli • Tool Page

fuzzuli is a url fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.

Motivation

In my application security testing journey that i have been doing for years, i found a lot critical backup files kept in externally accessible directories. While naming these files, common preferred words were used. (such as backup.zip, db.rar, conf.tar.gz etc). However, most of these files were named using the domain name where the application was located. Let's suppose we have a domain address fuzzuli.musana.net If the developer keeps critical backup files in the accessible directory, the possible file names will be like this.

fuzzuli.net.rar
fuzzuli.net.zip
fuzzuli.net.tar.gz
...
other file compression extensions
...
fuzzulinet.rar
fuzzulinet.zip
...
fuzzulimusana.rar
fuzzulimusana.7z
...
musana.fuzzuli.zip
musanafuzzuli.rar
...
so on
...

It is not possible to find these files in the traditional wordlist approach.

Background

When naming these files, the domain name is often taken as a reference. I've encountered scenarios when naming these files where the dots in the domain are deleted, vowel letters are deleted, or the domain name is used as is. I took this into account when developing this tool. Therefore, when creating a domain-based wordlist, I took the variants without dots, without vowels, both without dots and without vowels. Then the domain passes from the following function after removing dots, vowel letters both dot and vowel letter.

It goes through the below function after domain is reversed in reverse method.

mixed method changes position of each subdomain. Then results goes through the below function.

Mathematical equation is like this.

shuffle method just shuffle subdomains and removes dots, vowel letters both dots and vowel letters. It does not itarate over each char in domain string.

fuzzuli consists of two main parts. One of them creates a wordlist dynamically. The other sends the HTTP request and checks the response for backup/sensitive file.

Flow chart of fuzzuli is the following.

flowchart

fuzzuli is using 7 different methods for creating wordlists. Let's see results for fuzzuli.musana.net

shuffle

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt shuffle

Show 418 Possibilities

regular

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt regular

Show 1815 Possibilities

withoutdots

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt withoutdots

Show 1340 Possibilities

withoutvowels

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt withoutvowels

Show 693 Possibilities

withoutdv

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt withoutdv

Show 473 Possibilities

reverse

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt reverse

Show 3531 Possibilities

mixed

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt mixed

Show 3729 Possibilities