fuzzuli

Motivation • Background • Installation • Usage • Running fuzzuli • Tool Page

fuzzuli is a url fuzzing tool that aims to find critical backup files by creating a dynamic wordlist based on the domain.

Motivation

In my application security testing journey that i have been doing for years, i found a lot critical backup files kept in externally accessible directories. While naming these files, common preferred words were used. (such as backup.zip, db.rar, conf.tar.gz etc). However, most of these files were named using the domain name where the application was located. Let's suppose we have a domain address fuzzuli.musana.net If the developer keeps critical backup files in the accessible directory, the possible file names will be like this.

fuzzuli.net.rar
fuzzuli.net.zip
fuzzuli.net.tar.gz
...
other file compression extensions
...
fuzzulinet.rar
fuzzulinet.zip
...
fuzzulimusana.rar
fuzzulimusana.7z
...
musana.fuzzuli.zip
musanafuzzuli.rar
...
so on
...

It is not possible to find these files in the traditional wordlist approach.

Background

When naming these files, the domain name is often taken as a reference. I've encountered scenarios when naming these files where the dots in the domain are deleted, vowel letters are deleted, or the domain name is used as is. I took this into account when developing this tool. Therefore, when creating a domain-based wordlist, I took the variants without dots, without vowels, both without dots and without vowels. Then the domain passes from the following function after removing dots, vowel letters both dot and vowel letter.

It goes through the below function after domain is reversed in reverse method.

mixed method changes position of each subdomain. Then results goes through the below function.

Mathematical equation is like this.

shuffle method just shuffle subdomains and removes dots, vowel letters both dots and vowel letters. It does not itarate over each char in domain string.

fuzzuli consists of two main parts. One of them creates a wordlist dynamically. The other sends the HTTP request and checks the response for backup/sensitive file.

Flow chart of fuzzuli is the following.

flowchart

fuzzuli is using 7 different methods for creating wordlists. Let's see results for fuzzuli.musana.net

shuffle

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt shuffle

Show 418 Possibilities

regular

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt regular

Show 1815 Possibilities

withoutdots

┌──(root㉿kali)-[/root/fuzzuli]
└─# echo https://fuzzuli.musana.net|fuzzuli -mt withoutdots

Show 1340 Possibilities

fuzzuli

Most Popular

fuzzuli

Motivation

Background

shuffle

regular

withoutdots