phra / rustbuster

A Comprehensive Web Fuzzer and Content Discovery Tool
https://iwantmore.pizza
GNU General Public License v3.0
522 stars 59 forks source link

Add support for csrf token in fuzzbuster module #18

Closed phra closed 5 years ago

phra commented 5 years ago

will fix #17

example usage: env RUST_BACKTRACE=1 RUST_LOG=rustbuster=debug cargo run -- -m fuzz -u http://localhost:3000/login -X POST -H "Content-Type: application/json" -b '{"user":"FUZZ","password":"FUZZ","csrf":"CSRF"}' -w examples/wordlist -w /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt -s 200 --csrf-url "http://localhost:3000/csrf" --csrf-regex '\{"csrf":"(\w+)"\}'