[Music]
hey guys hackersploit here back again
with
another video welcome back to the bug
bounty series
in this particular video we're going to
be taking a look at how to use w
fuzz all right now i am going to be
imposing a structure to
this series and i'm going to be starting
off uh
with each sort of phase during the the
security assessment or the bug bounty
hunt whatever you want to call it so
again we're starting off with scanning
and reconnaissance and i'll sort of move
on from there so for those
of you asking what exactly is going on
there you go so
i mentioned that i used wfaz in the
previous video and
again i got a lot of questions about it
so i thought why not start off with this
tool because
it really is an awesome tool so for
those of you wondering what
exactly wfuzz is and how it can help you
well w fuzz is essentially used to
discover web content and directories
however it gives us much more
functionality than that so its main
features are
content discovery or web content
discovery rather
and form manipulation or brute forcing
as it's also known as
which is sort of like an indirect
translation but you know it's known on
the streets
on the hacking streets anyway so we are
going to be using the sec list
word list as i've mentioned in the
previous video because
again i said i want to keep it
standardized so the set lists are going
to be quite important for this series so
i do recommend that you get them
you you get started with them all right
so
i have my terminal here and what i've
done for this particular video is i have
a wordpress
installation running locally on my local
network so
that i can demonstrate a few of the uh
awesome bits of functionality that w
fuzz offers in regards to
form manipulation and web content
discovery
all right so let's start off with form
manipulation and brute forcing and or
brute forcing all right so what i've
done is i'm currently running burp suite
here
and i've intercepted uh the a few
packets here let me just forward all of
them
and we can actually get started all
right so let's go back to our terminal
here
apologies and uh the command for w files
again is very very simple w fuzz and i'm
just going to open up the help menu
now i will not be covering every
parameter or every option here because
my goal is to cover the most important
bits and how to use it for both of these
functions
so this uh in in regards to web content
discovery
uh it is very very similar to a tool
like their bust app so i've covered
their buster before but
i i prefer using um i i prefer using
this tool
in rather than using their buster or deb
because this allows me to sort of
customize
uh the discovery uh in regards to what
exactly what files i can find
what i can exclude etc etc all right so
let's start off with form manipulation
so uh you can go ahead and take a look
at all of these commands i'll be
explaining them as we go so the first
thing i want to do
is i want to type in w fuzz all right
now when you type in w fuzz
uh you now need to specify whether or
not you want
uh to start off with your word list but
again i'll explain to you the premise of
what's going on here
so let's say i wanted to brute force
this wordpress
login page right away which as we know
is wordpresslogin.php
all right now by default as i've
mentioned and i've taught before in
other videos
you can do this with burp suite and you
can also do it with the community
edition of web suite
however the issue is it does throttle
the amount of requests you can send to
the web server
which is uh both a good thing and a bad
thing because
on one hand you it can actually cause a
dos attack depending on the type of
server
and of course the good thing is that uh
well the bad thing is it it can take a
lot of your time so
with this particular tool that being
doubly fussed we can essentially perform
this brute force and customize
how we want it done all right so i'll
explain this in a second
so let's say we want to brute force this
login page all right but we have the uh
we have the email or the username
that's just one example and i'll show
you what i'm talking about so
uh i'm currently using foxyproxy and we
have the bug proxy uh
intercepting currently so i'm just gonna
hit some test information and i'll
put the password as one two three four
and it log in and
hopefully that gets intercepted and i'll
explain what what i'm talking about
so this is the post request that is
being sent to the server so you can see
that our two parameters here
are log and pwd which is an uh
abbreviation for password so the values
are
the most important bits here so we have
the first value which is test
and that is the username or email value
and we have pwd which is the password so
let's say we are trying to brute force
the password
we already have the email now for this
particular case i'm not really going to
be focusing on brute forcing it
i'm simply going to show you how to do
it so this is very very important in
regards to the post request and
understanding what
two parameters exist here and which one
of them you want to fuzz i'll get to
that and the first variable in a second
so this can work on any
login page regardless of whether it is a
cms like wordpress or joomla
it could be any other admin pages as
long as you understand
uh how the parameters are being saved
and you know in in
in what form they are being sent in the
request so let's get into this right now
so i'll go back into my terminal and
i'll type in w
fuzz all right so w fuzz and if we just
open up the help menu
you can see that the c command let me
just go up here which i'll
uh sort of show you what it means if i
can find it here there we are
the c command is what we'll use and that
will allow us to output with color so
we'll also use that right now
all right so w fuzz let me just clear
that out
all right w fuzz and we want to use the
c
command so that is output with colors
and then we specify
the word list we want to use now you can
also specify the payload and
of course the payload for a particular
word list would be would be the file
payload
so for example i could say uh for a
payload
you specify that with the parameter z
and then the name of the payload which
is file and then a comma
and then the directory of the word list
so i could say user
share word lists i want to use set list
but i've already created a test
um i have already created a test word
list
for myself so that that is one example
now when talking about
using uh the on talking about using a
word list itself that is
denoted by the w option so again uh root
desktop and we are going to go to word
list
right over here wordlist.txt and the
reason i've created is because i just
want to keep it really really simple
we're not going to brute force anything
all right so now we need to understand
what results to exclude
all right so we've specified our word
list and that's perfectly fine so what
what do we need to exclude
we want to exclude all the invalid
attempts all right now with wordpress
uh if we have um an incorrect password
so let me just forward that you can see
that the uh the message we get is
invalid and of course we can specify
that
by using the hs command so again
the hs command is very very simple so
let me just open that
up in a new window and i know i'm not
using terminator but i'll explain why in
a second so
let me just open that up uh so if you
take a look at the
hs command all right so the hs command
allows us
let me just zoom out the hs command
right over here allows us to show or
hide responses
with the specified rejects all right so
rejects is a
particular collection of strings so
ss will show the the responses that
you've specified so
if we said ss that would show us the
invalid attempts
and hs would show us the it'll
essentially hide the invalid attempts
so now that we can we have understood
that let's actually put that in so that
is
hs and we type in invalid all right and
then after
after this we essentially need to put in
uh our our post request all right now
our post request
again as i said is sorted very very
differently and what we're looking for
is the two parameters
that we want to fuzz all right so for
example i can say
d and that again is what we're going to
be using for the post
all right so if i can just find it over
here so that you can get the official
description so there we are post
data used use the post data example
ids et cetera et cetera so these can be
you can pass as many parameters as you
want
as long as they're included in the
within the post uh within the post
request all right so uh in the post
request
if we just test that out so i'm going to
just say test
test and we'll just say login and we
just check
you should be able to see the post
request and the parameters for wordpress
so we'll give that a few seconds and for
some reason oh there we are so we're
looking for log
and pwd all right so what we can do is
we can copy that or we can simply just
type it out which i'll do so that we can
understand what's going on all right so
we say log is equal to and that is the
parameter for
the username now we already have the
username or the email so
the email i believe was admin at
example.com if i'm not wrong that is
what i set for this particular wordpress
installation
example.com and of course after that we
have the password so
again that is denoted by pwd so and pwd
is equal to and in here is where we will
put our fuzz
variable all right so you might be
wondering what exactly is the fuzz
variable
in regards to w fuzz all right so the
first variable
is w fuzz's way of identifying where it
should be inserting the word from a word
list
all right so this is the particular
parameter you
will be fuzzing essentially or where the
words in the word list will be
replaced all right so for the password
we simply type in
fuzz so when w fuzz executes this
command it will look for the first
variable and this is the value it will
essentially
replace with the words in the word list
now that is clear we can move on
all right so it close the brackets here
and we specify the url with u
and then we specify the login url which
is again right over here and that is
http
192.168.1.109 and that is
wordpress login.php excellent so now we
can paste that in right over here
and that is our login our login page and
once we hit enter now of course i do not
have the password
uh the the real password the real
password
within the word list i have about five
words i'm simply showing you that it
does work
so i'm going to hit enter and there you
are you can see that immediately we get
we we get our requests and we
essentially get our responses right over
here
now you can see that by default if i'm
to just forward this right over here
the the default response will of course
give us a page back which is why we get
our 200 status codes
here and of course you can see right
over here we have the response the lines
the word and the payload that was given
right over here so we do not have any
successful passwords that were we were
able to get
uh and of course you can change this out
by saying or using the variable
fuzz 2 all right so i'll show you how to
do that in a second so
we'll use the same command right over
here but now
we can use the same word list for both
the username and the password
all right so we can say for example for
the email
we can also save files to however first
two is d
is denoted very differently so it is
fuzz2
zed all right so first do z and that
again
will be uh it will essentially use this
this word list
for both the username and the password
and so we can hit enter as well
and again we don't get any right over
here fatal exception first
words and number of payloads do not
match and there you are you you get the
response so
that is how to use w fuzz for um
for form manipulation or brute forcing
uh now let's talk about directory brute
forcing which is very very similar to
what tear buster and derb do
a lot of tools do it but i personally
like
w fuzz for this now one thing to take
into consideration is the fact that
uh that any directory brute forcing tool
is going to be extremely noisy and can
cause a dos attack if the server is
unable to handle
the amount of requests that's why with a
tool like dearbuster you have the
ability to change the amount of requests
you want to send to that particular web
page
so do take this into consideration when
performing any tests on any particular
target
it's very very important all right so
let's get started with
directory brute forcing now as i said
we're going to be using the set lists
wordless
and more more more uh more specifically
we're going to be using the web content
and the svn digger
word lists which are specified or were
created specifically
for wfas and dearbuster so for discovery
really so i'll show you the directory
right over here
so i type in wfas and the word list is
user
share sorry that is word list and that
is under set lists
and that is under discovery and we're
looking for web content
and we're looking for the svn digger and
we'll use alt.txt all right so all
uh dot txt or all theirs whatever you
feel is appropriate for your particular
security assessment we then need to
specify
uh if i can just open up the other
terminal here we need to specify the hc
command
all right so the hc command will hide
the responses
with the specified code lines words or
characters
so again the status codes it allows you
to hide responses
with particular status codes so for
example if we wanted to hide uh
responses with the status codes of for
example 404
or 403 we can do that and that will give
us only
the directories or the files that do
exist all right and that's exactly what
we're going to do
so we can type in hc
all right and after that we type in the
status codes we want to exclude
so that is the status code 403 and 404
and you can separate them
with commas right over here and after
that we type in our url which i believe
i have copied onto my clipboard
and i am going to hit enter all right
and this is going to begin
uh for some reason we're getting an
error here apologies
uh did i specify the url url parameter
or the url option here
um looks like uh we weren't
apologies guys i forgot to place the
fuzz keyword and this something
that you need to take into consideration
so let me just clear that up so
uh depending on what web server you're
targeting and
the directory and the sub directory you
want to fuzz
or you want to perform your directory
brute forcing on again you need to
specify
the fuzz variable i for some reason just
forgot this
i do apologize guys so if i want to
directly
um brute force the top most directory
which is the root directory of the web
page
or the web server uh so i'll essentially
just do it after
uh 109. i'd want i'm not really going
into any directory so
i want to first this directory so i
simply put in the variable fuzz and that
should begin the fuzzing process right
over here
and that is performing our directory
brute force so you can go ahead and take
a look at all the responses here
so you have the id the response and as
you can see it goes through all and is
excluding
all the 404 and the 403 status quo or
the response codes whatever you want to
call them
so you have the word the character and
the payload which is essentially the
file
it was able to uh to essentially find or
detect so
you can see we have the readme.html
license.txt index.php
wp content or wordpress content wp admin
so
it's doing what their buster does and of
course it is uh it is a great
alternative and i personally
like using it all right so you can use w
fuzz for a variety of other
uh bits of functionality but in my
opinion it does it really really well
in regards to form manipulation or brute
forcing and
directory brute forcing which again is
done by tools similar
or like dear buster or deb so again let
me know what you guys think that's going
to be it for this video
thank you so much for watching if you
have any questions or suggestions
let me know in the comment section on my
social networks or
at the forum at hackersploit.org and
i'll be seeing you
in the next video
[Music]
you