Skip to content

This tool use fuuzzing to try to bypass unknown authentication methods, who knows...

Notifications You must be signed in to change notification settings

carlospolop/fuzzhttpbypass

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

14 Commits
 
 
 
 

Repository files navigation

FuzzHTTPBypass

This tool use fuuzzing to try to bypass unknown authentication methods, who knows...

This is mainly for CTFs.

Installation

You only need to have installed wfuzz

pip3 install wfuzz

Features

  • [+] Get and show GET code, cookies sent by server and content if redirect (all of this in the provided url)
  • [+] Fuzz HTTP Verbs(Methods): GET, HEAD, POST, DELETE, CONNECT, OPTIONS, TRACE, PUT, INVENTED
  • [+] Fuzz HTTP Headers: Forwarded, X-Forwarded-For, X-ProxyUser-Ip, Referer, User-Agent, Cookies
  • [+] Fuzz HTTP Authentication: Basic and NTLM
  • [+] Filter by code or by words (appearing or not)
  • [+] Autocontained

Example

Show responses that do not return code 403 of url http://example.com/index.php

./fuzzhttpbypass.py -f notcontains,403 -u http://example.com/index.php

Responses that do not contains the code 240 (show all) in http://example.com/index.php

./fuzzhttpbypass.py -f notcontains,240 -u http://example.com/index.php

Responses that do not contains the word "Invalid" in http://example.com/index.php (Currently, the Wfuzz API has problems with spaces so we can't use them)

./fuzzhttpbypass.py -f notcontains,Invalid -u http://example.com/index.php

About

This tool use fuuzzing to try to bypass unknown authentication methods, who knows...

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages