> For the complete documentation index, see [llms.txt](https://robertos-notebook.gitbook.io/vuldarconcept/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://robertos-notebook.gitbook.io/vuldarconcept/enumeration/fuzzing.md).

# Fuzzing

\#Enumeracion #FUZZ

## WFuzz

`apt-get install -y wfuzz`

Fuzzing es una tecnica utilizada para buscar sobre la estructura de un sitio web, usualmente se utiliza el wordlist 2.3-medium

{% code fullWidth="true" %}

```bash
wfuzz -c -t 20 --hc=404 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt web.web/FUZZ
```

{% endcode %}

Puedes agregaarYou can add the parameter `-f {FileName}` to save it somewhere.

## GoBuster

Otra herramienta que se puede utilizar para fuzzing

{% code fullWidth="true" %}

```bash
gobuster dir -u http://{Target}/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20
```

{% endcode %}

Tambien puedes probar con extensiones especificas

{% code fullWidth="true" %}

```bash
gobuster dir -u http://[Target]/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20 -x php
```

{% endcode %}

### Wordlists

> Webfuzz

* /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

> For APIs

* [/usr/share/wordlists/api.txt](https://gist.github.com/helcaraxeals/7c45201b1c957ecea82ef7800da4bfa4)

#### Fixing Wfuzz

```bash
sudo apt --purge remove python3-pycurl
sudo apt install libcurl4-openssl-dev libssl-dev
sudo pip3 install pycurl wfuzz
apt-get install -y wfuzz
```