Introduction to web app fuzzing

Now that we have a clear understanding of the fuzzing concept, the terminology, and the attack types, let's start with web application-based fuzzing. As mentioned before, web application-based fuzzing is done by using URLs, forms, headers, and methods as the primary fuzz vectors. In this chapter, we will be using the following tools for fuzzing an HTTP-based web application: Wfuzz, Ffuf, and Burp Suite. Before moving forward, let's install the tools outlined in this section to hunt logical bugs.

Fuzzer installation (Wfuzz)

Wfuzz is a Python-based web application fuzzer that uses the replacive technique to replace the FUZZ keyword in the command with the fuzz vectors given to the fuzzer...