Diffuzz 4.0.0

Web fuzzer finding differences based on response diffing

Diffuzz

A fuzzer finding vulnerabilities based on response diffing

• Disclaimers
• Requirements
• Why
• Usage
• Help

Disclaimers

• This is considered to be a beta release, and may contain bugs and unintentional behavior. Consider yourself warned!

Requirements

Diffuzz requires HTTPDiff and HTTPInsert which can be install with python3 -m pip install httpdiff httpinsert or python3 -m pip install -r requirements.txt.

Why

Why create another fuzzer when so many already exists?

Most (not all) fuzzing tools rely on hardcoded values or regexes for differentiating responses. This is simply not good enough in many cases. This tool is made to minimize false-negatives, and to find vulnerabilities that are easily overlook by utilizing hardcoded values, regexes, and even manual testing. Some tools do provide advanced filtering, which still is not good enough for discovering minor deviations in responses.

Diffuzz uses HTTPDiff to analyze all sections of the responses; the status code, reason, headers, body, response times, errors, etc. This allows the fuzzer to find minor deviations in behavior, which may be a vulnerability or perhaps some noteworthy behavior.

Usage

$ diffuzz -u https://example.site/endpoint?param=value -w wordlists/sqli.txt
[INFO] Starting DualSniper scan: 1 insertion point(s), 10 threads, output=pretty
  [200] [Query/param] 'value' "value' or '1'='1"
        changed (p1/p2): body=0/25
[INFO] Scan complete: 1 finding(s) in 2.3s

Findings print to stdout; the [INFO] lines are logs and print to stderr, so the two never mix.

Wordlist formats

Most scan types read one payload per line. The multi-payload attacks split each line on the §§§§ separator:

• Sniper / BatteringRam — one payload per line.

• PitchFork / ClusterBomb — one payload per insertion point per line, separated by §§§§. With two insertion points: payload_ip1§§§§payload_ip2.

• DualSniper / DualBatteringRam — two payloads to compare per line: payload1§§§§payload2.

• DualPitchFork — two payload sets to compare, set 1 first then set 2, each with one payload per insertion point, all separated by §§§§:

  set1_ip1 §§§§ set1_ip2 §§§§ set2_ip1 §§§§ set2_ip2
  

  For example, with insertion points on q and y, comparing a benign set against an injection set:

  benign§§§§zzz§§§§' OR 1=1--§§§§zzz
  

Prefix a line with URLENCODED: to have its payloads URL-decoded before use (and reported back URL-encoded).

Help

usage: diffuzz [-h] (--url URL | --request REQUEST) --wordlist WORDLIST [--method METHOD]
               [--header HEADER [HEADER ...]] [--body BODY] [--https] [--proxy PROXY] [--threads THREADS]
               [--allow-redirects] [--verify] [--disable-encoding] [--output-format {pretty,json,payloads}] [--json]
               [--payloads-only] [--output OUTPUT] [--no-color] [--verbose] [--debug] [--quiet] [--scan-query]
               [--scan-path] [--scan-headers] [--scan-body] [--scan-type SCAN_TYPE] [--sleep SLEEP]
               [--calibration-sleep CALIBRATION_SLEEP] [--timeout TIMEOUT] [--ignore-errors] [--no-analyze-all]
               [--num-calibrations NUM_CALIBRATIONS] [--num-verifications NUM_VERIFICATIONS]

An awesome web fuzzer

options:
  -h, --help            show this help message and exit
  --wordlist WORDLIST, -w WORDLIST
                        Specify wordlist to use

target:
  --url URL, -u URL
  --request REQUEST, --req REQUEST, -r REQUEST
                        Specify a file containing a raw request for scanning

request:
  --method METHOD, -m METHOD
  --header HEADER [HEADER ...]
  --body BODY, -b BODY  Specify content to be in the body of the request
  --https, --tls
  --proxy PROXY, -p PROXY
  --threads THREADS, -t THREADS
  --allow-redirects, -ar
                        Specify if requests should follow redirects
  --verify              Verify SSL certificates
  --disable-encoding    Disable default encoding of payloads

output:
  --output-format {pretty,json,payloads}, -of {pretty,json,payloads}
                        How to print findings: 'pretty' (human readable, default), 'json' (one JSON object per line
                        with full detail), 'payloads' (just the triggering payload(s), one finding per line)
  --json, -j            Shortcut for --output-format json
  --payloads-only, -po  Shortcut for --output-format payloads (minimal: just the payloads)
  --output OUTPUT, -o OUTPUT
                        Write findings to a file instead of stdout (logs still go to stderr)
  --no-color            Disable colored output (color is auto-disabled when piping)

verbosisty:
  --verbose, -v
  --debug, -d
  --quiet, -q           Suppress calibration/progress logs on stderr (only errors + findings)

scan:
  --scan-query
  --scan-path
  --scan-headers
  --scan-body
  --scan-type SCAN_TYPE
                        Specify which type of scan to perform (Sniper, DualSniper, PitchFork, DualPitchFork,
                        ClusterBomb, DualClusterBomb, BatteringRam, DualBatterinRam)
  --sleep SLEEP, -s SLEEP
                        Determines how long (ms) the scanner should sleep between each request during scan
  --calibration-sleep CALIBRATION_SLEEP, -cs CALIBRATION_SLEEP
                        Determines how long (ms) the scanner should sleep between each request while calibrating
  --timeout TIMEOUT     Determines the timeout duration (s) for each request
  --ignore-errors, -ie  Ignore errors if any errors occurs during calibration

analyzer:
  --no-analyze-all      Make analyzer skip analyzing the body if the content length is static
  --num-calibrations NUM_CALIBRATIONS
                        Specify how many requests should be sent during calibration
  --num-verifications NUM_VERIFICATIONS
                        Specify how many times an endpoint should be verified/re-tested