ryofuzz

README

ryofuzz

Offensive web vulnerability fuzzer. Discovers unknown bugs through behavioral analysis, coverage-guided mutation, and intent mapping.

  ╔═══════════════════════════════════════════╗
  ║             ryofuzz v0.4.0                ║
  ║    Offensive Web Vulnerability Fuzzer     ║
  ║    github.com/renansj/ryofuzz             ║
  ╚═══════════════════════════════════════════╝

What makes it different

Most scanners check for known vulnerabilities. ryofuzz discovers unknown ones.

• Behavioral mode: maps how the server processes input, then attacks the logic gaps
• Guided mode: AFL++-style coverage-guided evolutionary fuzzing for web
• Smart mode: type-aware payload generation with false positive filtering
• Nuclei compatible: runs 10,000+ community templates natively

Installation

# go install
go install github.com/renansj/ryofuzz@latest

# Binary download (Linux)
curl -Lo ryofuzz https://github.com/renansj/ryofuzz/releases/latest/download/ryofuzz-linux-amd64
chmod +x ryofuzz && sudo mv ryofuzz /usr/local/bin/

# macOS Apple Silicon
curl -Lo ryofuzz https://github.com/renansj/ryofuzz/releases/latest/download/ryofuzz-darwin-arm64
chmod +x ryofuzz && sudo mv ryofuzz /usr/local/bin/

# From source
git clone https://github.com/renansj/ryofuzz.git && cd ryofuzz
go build -ldflags="-s -w" -o ryofuzz . && sudo mv ryofuzz /usr/local/bin/

Requires Go 1.22+.

Modes

Behavioral (intent mapping)

Maps server behavior first, then attacks based on what it learns. Sends ~120 structured probes to understand:

• What type of input the server expects (URL, path, ID, text, JSON)
• What the server does with it (fetch, reflect, execute, query database)
• Where validation boundaries are (which characters change behavior)
• Then targets the specific vulnerability class that matches

ryofuzz -u "http://target/api?url=http://example.com" --mode behavioral
ryofuzz -u "http://target/search?q=test" --mode behavioral

Guided (AFL++ for web)

Coverage-guided evolutionary fuzzing. Keeps inputs that trigger new server behaviors, mutates those further. Gets smarter over time.

ryofuzz -u "http://target/api?id=1" --mode guided -n 10000 -c 50
ryofuzz -u "http://target/api" -d '{"user":"test"}' --mode guided -n 50000

Smart (default)

Known payloads + type-aware smart generation + behavioral differential analysis. Good balance of speed and coverage.

ryofuzz -u "http://target/api?id=1&name=test" -t all -c 50
ryofuzz -u "http://target/api" -d '{"user":"admin","role":"viewer"}' -t sqli,ssti

Payloads / Mutate

payloads = only known payloads, no mutations. mutate = radamsa-style random mutations only.

ryofuzz -u "http://target/search?q=test" --mode payloads -t xss
ryofuzz -u "http://target/api" -d '{"data":"test"}' --mode mutate -n 10000

Vulnerability Modules (38)

Module	What it tests
sqli	SQL Injection (error, time, boolean, union, stacked, OOB)
xss	Cross-Site Scripting (context-aware: only confirms when executable in HTML)
ssti	Server-Side Template Injection (Jinja2, Twig, Freemarker, Thymeleaf, Mako, Pebble, Velocity, EJS, Pug, Handlebars, Smarty)
ssrf	Server-Side Request Forgery (AWS/GCP/Azure metadata, IP bypass, protocol smuggling)
cmdi	OS Command Injection (Linux/Windows, time-based, bypass)
lfi	Local File Inclusion (traversal, PHP wrappers, null byte, log poisoning)
xxe	XML External Entity (file read, blind OOB, SSRF via XXE)
nosqli	NoSQL Injection (MongoDB operators, JS injection)
idor	Insecure Direct Object Reference
redirect	Open Redirect
crlf	CRLF Injection / Response Splitting
prototype	Prototype Pollution (Node.js)
jwt	JWT Algorithm Confusion / alg:none / JWK injection
mass-assign	Mass Assignment / Parameter Pollution
race	Race Conditions
smuggling	HTTP Request Smuggling
cors	CORS Misconfiguration
csp	Content Security Policy analysis
graphql	GraphQL Introspection / Batching
deser	Insecure Deserialization (PHP, Python, Java, Node, .NET)
ldapi	LDAP Injection
xpathi	XPath Injection
logic	Business Logic Flaws (negative values, zero amounts)
ratelimit	Rate Limit bypass
verb	HTTP Verb Tampering
hostheader	Host Header Injection
cache	Web Cache Poisoning
ws	WebSocket Security
prompt	AI/LLM Prompt Injection
cve	CVE-aware targeted fuzzing (auto-detects framework from headers)
cache-deception	Web Cache Deception (path suffix tricks to cache authenticated pages)
oauth	OAuth/OIDC flow attacks (redirect_uri bypass, state missing, PKCE downgrade)
upload	File upload bypass (extension tricks, polyglot, SVG XSS, null bytes)
pwreset	Password reset poisoning (Host header injection in reset emails)
hpp	HTTP Parameter Pollution (duplicate params, array injection)
csv	CSV/Formula Injection (DDE, formula injection via =, +, -, @)
email-inj	Email Header Injection (CRLF in email fields, BCC injection)
xssi	Cross-Site Script Inclusion (JSONP data leak, callback injection)
el	Expression Language Injection (SpEL, OGNL, MVEL, JEXL, JSP EL)

Features

Auto-detection of injection points

Automatically finds all fuzzable parameters:

• URL query params
• Path segments (numeric, UUID, hex)
• JSON body (nested fields)
• URL-encoded form body
• HTTP headers
• Cookies

Smart payload generation

Type-aware mutations based on detected value type:

• Integer: boundary values, overflow, type confusion
• Float: IEEE 754 edge cases, precision
• String: length variations, unicode, format strings
• URL: internal IPs, metadata, protocol smuggling, bypass patterns
• Email: header injection, domain tricks
• UUID: enumeration, format confusion
• JSON: nesting, prototype pollution, duplicate keys

False positive filtering

Context-aware filtering eliminates noise:

• Checks Content-Type before claiming XSS (only HTML is executable)
• Detects when server just echoes payload in error messages
• Verifies HTML context for reflection (body vs attribute vs script vs safe)
• Filters CVE probe errors that are just URL parse failures
• Suppresses 500 floods when >20% responses are errors

CVE-aware probing

Fingerprints the server via response headers, then generates targeted fuzzing:

• Apache: path traversal bypasses (CVE-2021-41773 style)
• Nginx: alias traversal, off-by-slash
• Express/Node.js: prototype pollution chains
• Spring/Java: SpEL injection, Spring4Shell patterns
• Next.js: middleware bypass (CVE-2025-29927)
• Django/Flask: debug pages, SSTI
• Laravel: Ignition RCE patterns
• ASP.NET: ViewState, padding oracle
• Tomcat: Ghostcat, manager paths

OOB callback server

Built-in out-of-band listener for blind vulnerability confirmation:

# Local (your IP is reachable from target)
ryofuzz -u "http://target/api" -t ssrf --oob 10.10.14.5 --oob-listen 8888 --oob-mode private

# Via ngrok
ryofuzz -u "http://target/api" -t ssrf --oob auto --oob-mode ngrok

# CTF (private network)
ryofuzz -u "http://10.10.10.50/api?file=x" -t ssrf --oob 10.10.14.5:8888 --oob-mode private

Web crawler

Discovers endpoints before fuzzing:

ryofuzz -u "http://target" --crawl --crawl-depth 3 -t all

Extracts: links, forms, API routes from JavaScript, sitemap.xml, robots.txt.

Authentication

# Bearer token
ryofuzz -u "http://target/api" -t all --auth bearer --auth-token "eyJ..."

# Form login (auto-extracts token)
ryofuzz -u "http://target/admin" -t all \
  --auth form --auth-url "http://target/login" \
  --auth-body '{"email":"user@test.com","password":"pass"}' --auth-field "token"

# Basic auth
ryofuzz -u "http://target/api" -t all --auth basic --auth-user admin --auth-pass secret

# API key
ryofuzz -u "http://target/api" -t all --auth custom --auth-token "sk-xxx" --auth-header "X-API-Key"

Auto-refreshes when session expires (detects 401/403).

Nuclei template compatibility

Runs nuclei community templates natively. 10,000+ templates for known CVEs.

# Setup (once)
git clone --depth 1 https://github.com/projectdiscovery/nuclei-templates.git ~/nuclei-templates

# Run CVE templates + fuzzing together
ryofuzz -u "http://target" -t all --nuclei-templates ~/nuclei-templates/http/cves/

# Filter by severity
ryofuzz -u "http://target" -t all --nuclei-templates ~/nuclei-templates/http/ --nuclei-severity critical,high

# Filter by tags
ryofuzz -u "http://target" -t all --nuclei-templates ~/nuclei-templates/http/ --nuclei-tags rce,ssrf,lfi

Plugin system

Extend with custom YAML checks:

# ~/.ryofuzz/plugins/custom-check.yaml
name: custom-waf-bypass
severity: critical
module: sqli-custom
owasp: "A03:2021 Injection"
cwe: CWE-89
payloads:
  - value: "' /*!50000OR*/ 1=1-- -"
    variant: mysql-versioned-comment
detection:
  method: contains
  patterns:
    - "syntax error"
    - "mysql"

ryofuzz -u "http://target" --plugins-dir ./my-plugins -t all

Output formats

# Terminal (colored, default)
ryofuzz -u "http://target" -t all

# JSON (for pipelines)
ryofuzz -u "http://target" -t all --format json -o results.json

# Markdown
ryofuzz -u "http://target" -t all --format markdown -o report.md

# HTML (self-contained dark theme with SVG charts)
ryofuzz -u "http://target" -t all --format html -o report.html

Proxy support

Route traffic through Burp Suite or ZAP:

ryofuzz -u "http://target/api?id=1" -t all --proxy http://127.0.0.1:8080

Full CLI reference

ryofuzz [flags]
ryofuzz version

Target:
  -u, --url string           Target URL (required)
  -X, --method string        HTTP method (auto-detected)
  -d, --data string          Request body (JSON or URL-encoded)
  -H, --header strings       Custom headers (repeatable)
  -b, --cookie string        Cookies

Fuzzing:
  -t, --tests string         Modules: all, sqli, xss, ssti, ssrf, ... (default "all")
      --mode string          Mode: smart, payloads, mutate, guided, behavioral, authz (default "smart")
  -n, --mutations int        Payload count for guided/mutate mode (default auto)
  -c, --concurrency int      Concurrent workers (default 20)
      --timeout int          Request timeout in seconds (default 15)
      --delay int            Delay between requests in ms
      --rate int             Max requests/second (0=unlimited)
      --follow               Follow redirects

Output:
  -o, --output string        Output file
      --format string        text, json, markdown, html, sarif (default "text")
  -v, --verbose              Verbose output

Auth:
      --auth string          Method: basic, bearer, form, cookie, custom
      --auth-user string     Username
      --auth-pass string     Password
      --auth-token string    Token/API key
      --auth-url string      Login URL (for form auth)
      --auth-body string     Login body (for form auth)
      --auth-field string    Token field in login response
      --auth-header string   Header name for token (default "Authorization")
      --auth-prefix string   Token prefix (default "Bearer")

Discovery:
      --crawl                Crawl before fuzzing
      --crawl-depth int      Max depth (default 3)
      --ignore-robots        Ignore robots.txt

OOB:
      --oob string           OOB domain/IP:port for callbacks (e.g., 10.10.14.5:8888)
      --oob-listen int       Listener port (default 8888)
      --oob-mode string      local, ngrok, private (default "local")
      --oob-wait int         Seconds to wait for OOB callbacks (default 3)

Nuclei:
      --nuclei-templates string   Path to nuclei-templates directory
      --nuclei-tags string        Filter by tags (comma-separated)
      --nuclei-severity string    Filter by severity (default "critical,high")

Advanced:
      --openapi string             URL to OpenAPI/Swagger spec for endpoint discovery
      --taint-scan                 Enable canary propagation for stored/second-order detection
      --authz-identities strings   Identities for authz testing (name:header:value, repeatable)
      --log-file string            Request/response JSONL log path (default ".ryofuzz-log.jsonl")

Plugins:
      --plugins-dir string   Custom plugins directory

Other:
      --proxy string         HTTP proxy (e.g., http://127.0.0.1:8080)

Detection quality

Confirmation loops (false positive reduction)

Time-based findings are automatically re-sent twice:

1. Same payload to confirm the delay reproduces
2. No-sleep variant (sleep(0)) to rule out network latency

If the delay does not reproduce, the finding is discarded silently.

Boolean-based SQLi findings are confirmed by sending the complementary payload (e.g., OR 1=2 after OR 1=1). If both responses are identical, it is not a real boolean oracle and the finding is discarded.

Coverage-guided corpus persistence

In guided mode, the evolved corpus is saved to .ryofuzz-corpus.json at scan completion and reloaded automatically on next run. This enables incremental fuzzing across sessions.

# First run: explores from scratch
ryofuzz -u "http://target/api?id=1" --mode guided -n 10000

# Second run: resumes from previous corpus
ryofuzz -u "http://target/api?id=1" --mode guided -n 50000

OOB callbacks for blind detection

Built-in HTTP listener with token correlation for blind SSRF, XXE, and RFI:

ryofuzz -u "http://target/webhook" -d '{"url":"http://x.com"}' \
  -t ssrf --oob 10.10.14.5:8888 --oob-listen 8888 --oob-mode private --oob-wait 10

The server generates unique tokens per payload. When the target makes an outbound request to the listener, the callback is correlated with the exact payload that triggered it, producing a confirmed critical finding.

Chain detection

Post-scan, ryofuzz correlates findings to detect attack chains with elevated severity:

• SSRF + metadata access = Cloud credential theft (critical)
• Open Redirect + OAuth flow = Account takeover (critical)
• XSS + CORS misconfiguration = Cross-origin data theft (critical)
• SQL injection + IDOR = Mass data exfiltration (critical)
• Prototype pollution = Potential RCE via template gadgets (critical)

Chain findings are appended automatically with [CHAIN] prefix.

Canary propagation (stored/second-order detection)

Injects unique canary strings into every parameter, then scans all other responses for their presence. If a canary injected at endpoint A appears in the response of endpoint B, it indicates stored/second-order injection.

ryofuzz -u "http://target/api" -t all --taint-scan --crawl

Differential authorization testing

Sends the same requests with multiple identities and compares results to detect IDOR, broken authentication, and privilege escalation:

ryofuzz -u "http://target/api/users/1" --mode authz \
  --authz-identities "anon:" \
  --authz-identities "userA:Authorization:Bearer TOKEN_A" \
  --authz-identities "admin:Authorization:Bearer TOKEN_ADMIN"

OpenAPI/Swagger import

Auto-discovers all endpoints and parameters from an OpenAPI spec:

ryofuzz --openapi https://target/swagger.json -t all

SARIF output (CI/CD integration)

ryofuzz -u "http://target" -t all --format sarif -o results.sarif
# Upload to GitHub Security tab via github/codeql-action/upload-sarif

Architecture

ryofuzz/
├── cmd/root.go                  # CLI orchestration
├── internal/
│   ├── behavioral/engine.go     # Behavioral intent mapping (Phase 1-2-3)
│   ├── fuzzer/guided.go         # Coverage-guided evolutionary fuzzer
│   ├── input/parser.go          # Injection point auto-detection
│   ├── engine/engine.go         # Concurrent request engine
│   ├── mutator/                 # Radamsa-style + smart type-aware mutations
│   ├── payloads/database.go     # 740+ embedded payloads
│   ├── vulns/                   # 29 vulnerability modules + CVE probe
│   ├── analyzer/                # Behavioral clustering + FP filter
│   ├── nuclei/runner.go         # Nuclei template executor
│   ├── reporter/                # text, json, markdown, html output
│   ├── oob/                     # OOB callback server
│   ├── auth/                    # Authentication manager
│   ├── crawler/                 # Web spider + JS parser
│   └── plugins/                 # YAML plugin loader
└── plugins/                     # Example custom checks

Examples

# Full scan with all modules
ryofuzz -u "http://target/api?id=1&name=test" -t all -c 50

# Understand server behavior first (recommended for research)
ryofuzz -u "http://target/endpoint?param=value" --mode behavioral

# Deep fuzzing for 0-day discovery
ryofuzz -u "http://target/api?id=1" --mode guided -n 50000 -c 100

# JSON API with auth
ryofuzz -u "http://target/api/users" -d '{"search":"test"}' \
  -t sqli,ssti,nosqli --auth bearer --auth-token "eyJ..."

# Crawl + fuzz + nuclei + HTML report
ryofuzz -u "http://target" --crawl -t all \
  --nuclei-templates ~/nuclei-templates/http/cves/ \
  --format html -o report.html

# Blind SSRF with OOB callbacks
ryofuzz -u "http://target/webhook" -d '{"url":"http://x.com"}' \
  -t ssrf --oob 10.10.14.5:8888 --oob-mode private

# Through Burp proxy
ryofuzz -u "http://target/api?q=test" -t all --proxy http://127.0.0.1:8080

# OpenAPI/Swagger auto-discovery
ryofuzz --openapi https://target/v2/swagger.json -t all

# Stored/second-order detection via canary propagation
ryofuzz -u "http://target/api/comments" -d '{"body":"test"}' -t all --taint-scan --crawl

# Differential authorization (detect IDOR/broken auth/privesc)
ryofuzz -u "http://target/api/users/1" --mode authz \
  --authz-identities "anon:" \
  --authz-identities "user:Authorization:Bearer USER_TOKEN" \
  --authz-identities "admin:Authorization:Bearer ADMIN_TOKEN"

# SARIF output for GitHub Security integration
ryofuzz -u "http://target" -t all --format sarif -o results.sarif

# Multi-target via stdin
cat urls.txt | ryofuzz -t sqli,xss

# Full request/response logging for reproducibility
ryofuzz -u "http://target/api?id=1" -t all --log-file scan.jsonl

# New modules: cache deception, OAuth, upload bypass
ryofuzz -u "http://target/account/profile" -t cache-deception
ryofuzz -u "http://target/oauth/authorize?redirect_uri=http://legit.com/cb" -t oauth
ryofuzz -u "http://target/upload" -d @file.png -t upload

Disclaimer

For authorized security testing and CTF challenges only. Do not use against systems without explicit permission.

Author

RyoSec - Renan Zapelini

License

MIT