ignis-sec / puff

Clientside vulnerability / reflected xss fuzzer
150 stars 17 forks source link

Accept urls from STDIN [Feature] #5

Closed uBadRequest closed 4 years ago

uBadRequest commented 4 years ago

Could you add the ability to pipe a list of urls into puff?

uBadRequest commented 4 years ago

For now ill just use a while loop :)

ignis-sec commented 4 years ago

I really like this idea, and i'll start working on this as soon as i can :)

ignis-sec commented 4 years ago

I hope this is what you had in mind too!

Running with stdin fuzzing mode:

cat urls.txt | node puff.js -w .\wordlist-examples\events.txt

cat urls.txt | puff -w .\wordlist-examples\events.txt

Where urls.txt is

http://example.com?query=FUZZ
https://another.com/page/#FUZZ

Running with stdin single payload mode:

cat urls.txt | node puff.js

cat urls.txt | puff

Where urls.txt is

http://example.com?query=<script>alert()</script>
http://example.com?query=javascript:alert()
https://another.com/page/#<script>alert()</script>