> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/tools/web-and-and-dns/web-fuzzing.md).

# Web Fuzzing

**ffuf:** A fast web fuzzer written in Go.

```
ffuf -w /path/to/wordlist -u https://target/FUZZ
```

[**Arjun**](https://github.com/s0md3v/Arjun)**:** This tool can find query parameters for URL enpoints. If you don't get what that means, it's okay, read along.

```
arjun -u https://api.example.com/endpoint
```

[**vaf**](https://github.com/d4rckh/vaf)**:** very advanced (web) fuzzer.

![](/files/-MZwUbjxuAePRkcac8Pp)

 [**parameth**](https://github.com/maK-/parameth)**:** This tool can be used to brute discover GET and POST parameters.

 [**ParamSpider**](https://github.com/devanshbatham/ParamSpider)**:** Mining parameters from dark corners of Web Archives.

![](/files/-MY4srEigYtXv3VnbVwk)

 [**smuggler**](https://github.com/defparam/smuggler): An HTTP Request Smuggling / Desync testing tool written in Python 3.

```
python3 smuggler.py -u <URL>
```

Reference: <https://raw.githubusercontent.com/gwen001/pentest-tools/master/smuggler.py>

[**DirDar**](https://github.com/blackhatethicalhacking/DirDar): DirDar is a tool that searches for (403-Forbidden) directories to break it and get dir listing on it.

[![asciicast](https://asciinema.org/a/391851.svg)](https://asciinema.org/a/391851)

&#x20;[**HackBar**](https://github.com/d3vilbug/HackBar)**:** HackBar plugin for Burpsuite.

![](/files/-MYEu8nLmpzXhWB3Rh9t)

**x8-Burp:** Discovering hidden parameters with burp.

{% embed url="<https://github.com/Impact-I/x8-Burp>" %}

[**jsql-injection**](https://github.com/ron190/jsql-injection)**:** jSQL Injection is a Java application for automatic SQL database injection.

![](/files/-MYM03x-Kn_uVgQSC3pk)

[**HTTP Request Smuggling Detection Tool**](https://github.com/anshumanpattnaik/http-request-smuggling)

![](/files/-MgwSsu4t-UreoUZSOnj)

## Bonus

{% embed url="<https://github.com/lutfumertceylan/top25-parameter>" %}

```
/cgi-bin/redirect.cgi?{payload}
/login?to={payload}
/out/{payload}
/out?{payload}
/redirect/{payload}
?action={payload}
?arg={payload}
?begindate={payload}
?board={payload}
?cat={payload}
?category={payload}
?categoryid={payload}
?checkout_url={payload}
?class={payload}
?cmd={payload}
?code={payload}
?command={payload}
?conf={payload}
?content={payload}
?continue={payload}
?date={payload}
?dest={payload}
?destination={payload}
?detail={payload}
?dir={payload}
?do={payload}
?doc={payload}
?document={payload}
?download={payload}
?email={payload}
?enddate={payload}
?exe={payload}
?exec={payload}
?execute={payload}
?feature={payload}
?file={payload}
?folder={payload}
?form={payload}
?func={payload}
?function={payload}
?go={payload}
?id={payload}
?image_url={payload}
?immagine={payload}
?inc={payload}
?include={payload}
?item={payload}
?join={payload}
?jump={payload}
?key={payload}
?keyword={payload}
?keywords={payload}
?l={payload}
?lang={payload}
?layout={payload}
?list_type={payload}
?load={payload}
?locate={payload}
?main={payload}
?menu={payload}
?mod={payload}
?module={payload}
?month={payload}
?name={payload}
?nav={payload}
?news={payload}
?next={payload}
?option={payload}
?p={payload}
?page={payload}
?path={payload}
?payload={payload}
?ping={payload}
?prefix={payload}
?print={payload}
?process={payload}
?q={payload}
?query={payload}
?read={payload}
?redir={payload}
?redirect={payload}
?redirect_uri={payload}
?ref={payload}
?reg={payload}
?region={payload}
?req={payload}
?return={payload}
?returnTo={payload}
?return_path={payload}
?return_to={payload}
?run={payload}
?rurl={payload}
?s={payload}
?search={payload}
?show={payload}
?site={payload}
?step={payload}
?target={payload}
?terms={payload}
?thread={payload}
?title={payload}
?topic={payload}
?type={payload}
?url={payload}
?view={payload}
?year={payload}
```

{% embed url="<https://github.com/afwu/leaky-paths>" %}