search

ffuf / ffuf

Fast web fuzzer written in Go
MIT License
12.8k stars 1.31k forks source link

FUZZ absolute URL #546

Open 0xAwali opened 2 years ago

0xAwali commented 2 years ago

it's not possible to FUZZ absolute URL e.g. I'm using

ffuf -request req.txt -w words.txt -u https://www.google.com

and req.txt is 

GET https://FUZZ/ HTTP/1.1
Host: www.google.com

ffuf instead of FUZZing absolute URL it will FUZZ Host Header

ffuf

this one will be awesome while facing reverse proxy , more details

https://blog.projectdiscovery.io/abusing-reverse-proxies-metadata/

https://blog.projectdiscovery.io/abusing-reverse-proxies-internal-access/

joohoi commented 2 years ago

Hi, I actually got a feature request for this, along with example code OOB, and it is definitely something that will be implemented in the near future!