Wfuzz 简单使用
最近在打 Vulnhub，需要使用到 wfuzz 进行参数模糊匹配，记录一下。
本篇文章参考：
1 工具介绍
在 Kali Linux 中，Wfuzz 是一个内置的工具，它是一个功能强大的 Web 应用程序安全测试工具，用于发现和利用 Web 应用程序中的漏洞和安全漏洞。
Wfuzz 的创建是为了促进 Web 应用程序评估中的任务，它基于一个简单的概念：它用给定有效负载的值替换对 FUZZ 关键字的任何引用，Wfuzz 中的有效负载是数据源。
Wfuzz 的一些主要特点和功能：
字典爆破：Wfuzz 支持使用自定义的字典文件对 Web 应用程序中的 URL、参数和请求进行爆破攻击，以发现隐藏的目录、文件和功能。
多种攻击类型：Wfuzz 支持多种攻击类型，包括基于字典的爆破、暴力破解、参数污染、异常检测等，可用于测试各种漏洞类型。
多种协议支持：Wfuzz 可以对 HTTP、HTTPS、POST、GET 等多种协议进行测试，以及支持使用代理服务器进行测试。
自动化和批量测试：Wfuzz 可以自动化执行测试任务，并支持批量测试，你可以使用配置文件来定义测试目标、字典文件和其他参数。
高度可定制：Wfuzz 具有丰富的配置选项和参数，可以根据需求进行定制，包括超时时间、线程数、重试次数等。
2 工具安装
Wfuzz 是 Kali Linux 默认自带的一款漏洞扫描工具，由于 Kali 中自带了 Wfuzz，所以怎么安装就不讲了，直接说说怎么使用：
root at kali in ~
$ wfuzz
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
* *
* Version up to 1.4c coded by: *
* Christian Martorella (cmartorella@edge-security.com) *
* Carlos del ojo (deepbit@gmail.com) *
* *
* Version 1.4d to 3.1.0 coded by: *
* Xavier Mendez (xmendez@edge-security.com) *
********************************************************
Usage: wfuzz [options] -z payload,params <url>
FUZZ, ..., FUZnZ wherever you put these keywords wfuzz will replace them with the values of the specified payload.
FUZZ{baseline_value} FUZZ will be replaced by baseline_value. It will be the first request performed and could be used as a base for filtering.
Examples:
wfuzz -c -z file,users.txt -z file,pass.txt --sc 200 http://www.site.com/log.asp?user=FUZZ&pass=FUZ2Z
wfuzz -c -z range,1-10 --hc=BBB http://www.site.com/FUZZ{something not there}
wfuzz --script=robots -z list,robots.txt http://www.webscantest.com/FUZZ
Type wfuzz -h for further information or --help for advanced usage.
3 工具使用
3.1 常用参数
使用 wpscan -h 查看参数用法：
root at kali in ~
$ wfuzz --help
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
* *
* Version up to 1.4c coded by: *
* Christian Martorella (cmartorella@edge-security.com) *
* Carlos del ojo (deepbit@gmail.com) *
* *
* Version 1.4d to 3.1.0 coded by: *
* Xavier Mendez (xmendez@edge-security.com) *
********************************************************
Usage: wfuzz [options] -z payload,params <url>
FUZZ, ..., FUZnZ wherever you put these keywords wfuzz will replace them with the values of the specified payload.
FUZZ{baseline_value} FUZZ will be replaced by baseline_value. It will be the first request performed and could be used as a base for filtering.
Options:
-h/--help : This help
--help : Advanced help
--filter-help : Filter language specification
--version : Wfuzz version details
-e <type> : List of available encoders/payloads/iterators/printers/scripts
--recipe <filename> : Reads options from a recipe. Repeat for various recipes.
--dump-recipe <filename> : Prints current options as a recipe
--oF <filename> : Saves fuzz results to a file. These can be consumed later using the wfuzz payload.
-c : Output with colors
-v : Verbose information.
-f filename,printer : Store results in the output file using the specified printer (raw printer if omitted).
-o printer : Show results using the specified printer.
--interact : (beta) If selected,all key presses are captured. This allows you to interact with the program.
--dry-run : Print the results of applying the requests without actually making any HTTP request.
--prev : Print the previous HTTP requests (only when using payloads generating fuzzresults)
--efield <expr> : Show the specified language expression together with the current payload. Repeat for various fields.
--field <expr> : Do not show the payload but only the specified language expression. Repeat for various fields.
-p addr : Use Proxy in format ip:port:type. Repeat option for using various proxies.
Where type could be SOCKS4,SOCKS5 or HTTP if omitted.
-t N : Specify the number of concurrent connections (10 default)
-s N : Specify time delay between requests (0 default)
-R depth : Recursive path discovery being depth the maximum recursion level.
-D depth : Maximum link depth level.
-L,--follow : Follow HTTP redirections
--ip host:port : Specify an IP to connect to instead of the URL's host in the format ip:port
-Z : Scan mode (Connection errors will be ignored).
--req-delay N : Sets the maximum time in seconds the request is allowed to take (CURLOPT_TIMEOUT). Default 90.
--conn-delay N : Sets the maximum time in seconds the connection phase to the server to take (CURLOPT_CONNECTTIMEOUT). Default 90.
-A, --AA, --AAA : Alias for -v -c and --script=default,verbose,discover respectively
--no-cache : Disable plugins cache. Every request will be scanned.
--script= : Equivalent to --script=default
--script=<plugins> : Runs script's scan. <plugins> is a comma separated list of plugin-files or plugin-categories
--script-help=<plugins> : Show help about scripts.
--script-args n1=v1,... : Provide arguments to scripts. ie. --script-args grep.regex="<A href=\"(.*?)\">"
-u url : Specify a URL for the request.
-m iterator : Specify an iterator for combining payloads (product by default)
-z payload : Specify a payload for each FUZZ keyword used in the form of name[,parameter][,encoder].
A list of encoders can be used, ie. md5-sha1. Encoders can be chained, ie. md5@sha1.
Encoders category can be used. ie. url
Use help as a payload to show payload plugin's details (you can filter using --slice)
--zP <params> : Arguments for the specified payload (it must be preceded by -z or -w).
--zD <default> : Default parameter for the specified payload (it must be preceded by -z or -w).
--zE <encoder> : Encoder for the specified payload (it must be preceded by -z or -w).
--slice <filter> : Filter payload's elements using the specified expression. It must be preceded by -z.
-w wordlist : Specify a wordlist file (alias for -z file,wordlist).
-V alltype : All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.
-X method : Specify an HTTP method for the request, ie. HEAD or FUZZ
-b cookie : Specify a cookie for the requests. Repeat option for various cookies.
-d postdata : Use post data (ex: "id=FUZZ&catalogue=1")
-H header : Use header (ex:"Cookie:id=1312321&user=FUZZ"). Repeat option for various headers.
--basic/ntlm/digest auth : in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ"
--hc/hl/hw/hh N[,N]+ : Hide responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
--sc/sl/sw/sh N[,N]+ : Show responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
--ss/hs regex : Show/hide responses with the specified regex within the content
--filter <filter> : Show/hide responses using the specified filter expression (Use BBB for taking values from baseline)
--prefilter <filter> : Filter items before fuzzing using the specified expression. Repeat for concatenating filters.
参数说明如下：
3.2 使用示例
3.2.1 模糊查询 GET
wfuzz -u "http://127.0.0.1/test.php?FUZZ=/etc/passwd" -w /usr/share/wfuzz/wordlist/general/common.txt
3.2.2 模糊查询 POST
wfuzz http://127.0.0.1/user.php -d "uname=FUZZ&pass=FUZZ" -w /usr/share/wfuzz/wordlist/general/common.txt
3.2.3 添加 Cookie 发起请求
wfuzz http://127.0.0.1/FUZZ -b cookie=value1 -w /usr/share/wfuzz/wordlist/general/common.txt
3.2.4 添加请求头
wfuzz http://127.0.0.1/FUZZ -w /usr/share/wfuzz/wordlist/general/common.txt -H "Referer: 127.0.0.1"
3.2.5 添加代理
wfuzz -u "http://127.0.0.1/test.php?FUZZ=/etc/passwd" -w /usr/share/wfuzz/wordlist/general/common.txt -p 127.0.0.1:1080:HTTP
3.2.6 输出到文件
wfuzz -u "http://127.0.0.1/test.php?FUZZ=/etc/passwd" -w /usr/share/wfuzz/wordlist/general/common.tx -f /tmp/outfile,json