pfuzz is a web fuzzer inspired by ffuf, which outputs the generated requests to stdout in the httpipe format instead of sending them.
$ # Fuzzing paths with a wordlist:
$ pfuzz -w /path/to/wordlist -u https://foo.io:1234/FUZZ{"host":"foo.io","port":"1234","req":"GET /api HTTP/1.1\r\nHost: foo.io:1234\r\n\r\n","tls":true}{"host":"foo.io","port":"1234","req":"GET /login HTTP/1.1\r\nHost: foo.io:1234\r\n\r\n","tls":true}{"host":"foo.io","port":"1234","req":"GET /home HTTP/1.1\r\nHost: foo.io:1234\r\n\r\n","tls":true}...
$ # Using words from stdin to fuzz the Authorization header:
$ generate-tokens | pfuzz -w - -u http://foo.io -H 'Authorization: Bearer FUZZ'{"host":"foo.io","req":"GET / HTTP/1.1\r\nHost: foo.io\r\nAuthorization: Bearer abc123\r\n\r\n","tls":false}{"host":"foo.io","req":"GET / HTTP/1.1\r\nHost: foo.io\r\nAuthorization: Bearer xyz1337\r\n\r\n","tls":false}...
$ # Using multiple wordlists to fuzz paths across multiple subdomains:
$ pfuzz -w /path/to/subdomains:SUB -w /path/to/paths:PATH -u http://SUB.foo.io/PATH{"host":"doc.foo.io","req":"GET /api HTTP/1.1\r\nHost: doc.foo.io\r\n\r\n","tls":false}{"host":"doc.foo.io","req":"GET /login HTTP/1.1\r\nHost: doc.foo.io\r\n\r\n","tls":false}{"host":"doc.foo.io","req":"GET /home HTTP/1.1\r\nHost: doc.foo.io\r\n\r\n","tls":false}{"host":"forum.foo.io","req":"GET /api HTTP/1.1\r\nHost: forum.foo.io\r\n\r\n","tls":false}...You can download precompiled binaries from the releases
page or install it with
go install github.com/codesoap/pfuzz@latest.
$ pfuzz -hUsage of pfuzz: -H value An HTTP header to use, e.g. 'Content-Type: application/json'. -X string The HTTP method to use. (default "GET") -d string Payload data as given, without any encoding. Mostly used for POST requests. -u string The URL of the target. -w value The path to a wordlist, and optionally a colon followed by a custom placeholder, e.g. '/path/to/username/list:USER'.Zero, one or more wordlists can be provided. If no custom placeholderis given, FUZZ is used instead; if multiple wordlists have no customplaceholder, FUZZ2, FUZZ3, etc. will be assigned. If multiple wordlistsare used, all permutations will be generated.One wordlist can use '-' instead of a path. It's words will be read fromstandard input.If no wordlist is used, only one request will be generated.